Description

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T06:17:17.463Z",
  "pubdate": "2026-09-02T06:17:17.463Z",
  "executiveSummary": "The Rank Math SEO WordPress plugin, in versions prior to 1.0.277.1, contains an improper access control vulnerability that results in unauthorized information disclosure.\nThe vulnerability occurs because the plugin fails to validate the password-protection status of WordPress posts when dynamically generating SEO metadata.\nThis flaw allows unauthenticated remote attackers to access and exfiltrate the content of password-protected posts by inspecting the publicly rendered SEO tags, such as meta descriptions and open graph properties.\nThe impact includes the exposure of sensitive, confidential, or private content intended only for authorized users, potentially leading to unauthorized data harvesting.\nNo authentication or specific privileges are required for exploitation, as the plugin processes the metadata for public consumption regardless of the post's visibility settings.\nThe risk is critical for sites utilizing password-protected posts for sensitive information, as the vulnerability circumvents standard WordPress authorization mechanisms.",
  "technicalDetails": "The vulnerability originates from a failure in the plugin's internal logic responsible for harvesting post content to populate SEO meta tags. In WordPress, posts designated as 'password protected' require the user to provide a valid password to view the post body content within the standard loop.\nRank Math SEO incorrectly assumes that the content acquisition process does not need to verify the post's visibility or authentication requirements before reading the post object. Specifically, the plugin retrieves the content from the database to generate tags like the 'og:description' or 'description' meta tags.\nWhen a post is requested, the plugin processes the post content to create an SEO snippet. During this generation phase, the plugin does not invoke the WordPress function 'post_password_required()', which is the standard security control for verifying if a user has authorized access to a protected post.\nAn unauthenticated attacker can exploit this by identifying the URL of a password-protected post and requesting the page source. Even though the browser or the standard template engine might enforce the password prompt for the main body, the SEO plugin injects the plaintext content of the post into the HTML head section metadata.\nThe attack flow is as follows: 1) The attacker identifies a target URL protected by a password. 2) The attacker sends an HTTP GET request to the target URL. 3) The server-side code execution of Rank Math SEO triggers, accessing the 'post_content' field of the protected post. 4) The plugin generates SEO meta tags containing a preview of the content, disregarding the password-protected status. 5) The server returns the HTML response including these meta tags. 6) The attacker extracts the sensitive information directly from the HTML head tags, bypassing the intended password-based access control.\nThis vulnerability is classified as an improper authorization flaw, specifically categorized under information disclosure. Because the plugin acts as a bridge between internal protected data and public-facing metadata, it bypasses the WordPress authentication layer entirely. This behavior persists across versions prior to 1.0.277.1, requiring immediate remediation to prevent unauthorized data exfiltration.\nThe scope of the impact is broad, as any content within the post body that is captured by the SEO snippet generator becomes publicly available to search engines and any actor performing simple HTTP requests to the target post."
}