CVE-2026-77782 PUBLISHED

Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt

Assigner: WPScan
Reserved: 21.08.2026 Published: 02.09.2026 Updated: 02.09.2026

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts.

Product Status

Vendor Unknown
Product Rank Math SEO
Versions Default: unaffected
  • affected from 0 to 1.0.277.1 (excl.)

Credits

  • Project Black finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE