CVE-2026-77783: CWE-639 Authorization Bypass Through User-Controlled Key in Rank Math SEO

The Rank Math SEO WordPress plugin before version 1.0.277 does not properly check if a post is publicly accessible before rendering its schema on the front end. This authorization bypass (CWE-639) enables unauthenticated users to retrieve schema and content metadata for posts that are not meant to be publicly visible, including draft, pending, private, scheduled, and password-protected posts. The vulnerability has a CVSS v3.1 base score of 3.7 (low), reflecting low impact on confidentiality and no impact on integrity or availability. There is no vendor advisory or patch available at this time, and no known active exploitation has been reported.

Unauthenticated attackers can disclose schema and associated content metadata of non-public posts, potentially exposing sensitive or unpublished information. The impact is limited to information disclosure with no integrity or availability impact. The low CVSS score reflects the limited scope and difficulty of exploitation due to the need to control the user key parameter.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin or disable schema rendering for non-public posts if possible. Monitor official Rank Math SEO communications for updates on patches or mitigations.