CVE-2026-77786CWE-863broken-access-control

CVE-2026-77786

Medium · published August 29, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
25.1
In the wild
Unconfirmed
What it is

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00331 · 25.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-29T10:17Z
References (1)
https://wpscan.com/vulnerability/b0f3dfdb-9f0a-418c-9ce5-6a2b2b1f1b49/ · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 29 AUG 06:00Z
    Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability
    cvelistv5