CVE-2026-77788: CWE-639 Authorization Bypass Through User-Controlled Key in Rank Math SEO

CVE-2026-77788 is an authorization bypass vulnerability (CWE-639) in the Rank Math SEO WordPress plugin prior to version 1.0.277. The flaw arises from insufficient verification of ownership when updating metadata rows, allowing users with the Author role or higher to overwrite metadata belonging to other posts or users, including those with higher privileges. This can lead to unauthorized modification of data within the WordPress environment.

The vulnerability allows users with Author-level privileges or higher to overwrite arbitrary post and user metadata, including data belonging to higher-privileged users. This could lead to integrity issues within the WordPress site, potentially enabling privilege escalation or manipulation of site content or user information. There is no indication of confidentiality or availability impact, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's official channels for updates and apply any official fixes once available. Until a patch is released, restrict user roles to minimize exposure and avoid granting Author or higher privileges to untrusted users.