Description

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-02T06:17:17.567Z",
  "pubdate": "2026-09-02T06:17:17.567Z",
  "executiveSummary": "The Rank Math SEO WordPress plugin, specifically versions prior to 1.0.277, contains an information disclosure vulnerability.\nThe vulnerability type is an Improper Access Control flaw that exposes structured data (schema) related to non-public content.\nAffected systems include WordPress installations utilizing Rank Math SEO versions earlier than 1.0.277.\nThe impact allows unauthenticated remote attackers to retrieve metadata and content associated with private, draft, pending, scheduled, or password-protected posts that should remain inaccessible to unauthorized users.\nThe risk implication is significant as it permits the unauthorized exposure of sensitive or proprietary site content that is not yet ready for public consumption or is restricted by design.\nThere are no specific authentication or privilege requirements for an attacker; the vulnerability is exploitable by unauthenticated visitors over the network via standard HTTP requests to the public-facing frontend.\nThis flaw facilitates the discovery of confidential site planning, embargoed news, or sensitive organizational drafting workflows.",
  "technicalDetails": "The root cause of this vulnerability lies in the plugin's frontend schema rendering logic. Rank Math SEO automatically generates structured data markup (JSON-LD) for WordPress posts to improve search engine indexing. In versions prior to 1.0.277, the plugin's implementation failed to perform necessary access control checks on the post object before rendering this schema.\nStandard WordPress API behavior dictates that private, draft, pending, or scheduled posts should only be accessible to users with appropriate capabilities (e.g., editors or administrators). The Rank Math plugin bypassed these security constraints by fetching and processing the post data regardless of its visibility status or authorization requirements.\nThe exploitation flow begins when an unauthenticated attacker identifies a target post ID. By crafting a request to the frontend where Rank Math intercepts the query, the attacker can force the plugin to output the schema data for the specified post. Because the plugin does not verify if the current visitor has permission to view the content, it proceeds to populate the JSON-LD schema with sensitive information retrieved directly from the WordPress database.\nThis metadata often includes post titles, excerpts, author information, and specific content snippets that are intended to be hidden. Even in cases where the primary content is password-protected, the schema data rendered by Rank Math may contain sufficient details to breach the confidentiality of the protected document.\nThis vulnerability is classified as an improper authorization check. The lack of a call to 'is_post_type_viewable()' or a check of the 'post_status' attribute against the current user's session before generating the output allows for a systemic information leak across the site's post types.\nFrom a post-exploitation perspective, an attacker can automate the enumeration of post IDs to scrape sensitive data from thousands of internal drafts or private pages. This provides a roadmap of an organization's future publishing strategy or exposes sensitive information stored within private post types."
}