Executive brief
Rank Math SEO is a popular WordPress plugin that manages schema markup and search engine optimization. The plugin fails to verify whether posts are publicly visible before rendering their schema and content, allowing anyone visiting a website to view draft, pending, private, scheduled, and password-protected posts through a query parameter—revealing sensitive information that WordPress normally hides from the public.
Technical details
This is an Insecure Direct Object Reference (IDOR) vulnerability in the Rank Math SEO WordPress plugin versions before 1.0.277. The plugin's schema rendering functions do not validate post visibility status before exposing post metadata (headline, description, excerpt) and content on the front end. An unauthenticated attacker can append a post_id parameter to any published post URL to disclose schema and content of non-public posts. The vulnerability requires no authentication or user interaction; a simple HTTP request with a guessed or enumerated unpublished post ID exposes the content. WordPress's standard access controls prevent direct requests to unpublished posts, but the Rank Math plugin circumvents these checks. The vulnerability is fixed in version 1.0.277.
Affected products
- Rank Math SEO before 1.0.277
Timeline
- 2026-08-31: disclosed
- 2026-09-02: advisory: CVE-2026-77783 published on NVD