Description

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other users' non-public posts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-02T06:17:17.763Z",
  "pubdate": "2026-09-02T06:17:17.763Z",
  "executiveSummary": "The Rank Math SEO plugin for WordPress, in versions prior to 1.0.277, suffers from an Improper Access Control vulnerability. This security flaw enables authenticated users with the Author role or higher to access sensitive information belonging to posts that are non-public, such as drafts or private posts.\nThe vulnerability type is an Insecure Direct Object Reference (IDOR) or a missing authorization check within the plugin's metadata retrieval functionality. By failing to validate the requester's permissions against the target post's privacy status, the plugin inadvertently exposes the title, full body content, and SEO-specific metadata of restricted posts.\nThis represents a significant risk to confidentiality. An attacker possessing valid Author-level credentials can enumerate and scrape content meant to remain private, including sensitive drafts, intellectual property, or upcoming publication content. Successful exploitation requires an active WordPress session with at least Author-level privileges, but does not require higher-level administrative access. Remediation requires an immediate update to the patched version provided by the vendor.",
  "technicalDetails": "The vulnerability originates from a failure in the Rank Math SEO plugin to perform adequate authorization checks when processing requests for post data and associated SEO metadata. In the affected versions, the plugin's internal functions responsible for fetching post details do not verify if the current user possesses the requisite capabilities to read the specific post referenced by the requested post ID.\nThe root cause is a deficiency in the access control logic. WordPress utilizes a granular capability system (e.g., 'read_post'), yet the plugin fails to invoke these checks before returning serialized post data or metadata in response to a user request. Consequently, any authenticated user with the Author capability—which allows them to manage their own posts—can manipulate the input parameters of the plugin's requests to reference the IDs of posts belonging to other users or posts that are currently set to 'private' or 'draft' status.\nThe attack flow proceeds as follows: An authenticated attacker identified as an Author identifies an endpoint or AJAX action within the Rank Math plugin intended for post metadata retrieval. The attacker sends a crafted request, often via HTTP POST or GET, containing the specific ID of a target post for which they lack legitimate access rights. Because the plugin does not enforce a policy check to verify if the post is published or if the user is authorized to view that particular object, the backend function proceeds to fetch the requested record from the database. The plugin then generates a response, typically in JSON format, containing the target post's sensitive data, including its title, raw body text, and SEO-related configuration metadata.\nThe post-exploitation impact is substantial, as this allows for unauthorized content exfiltration. An attacker can systematically enumerate post IDs—particularly if predictable or sequential ID assignment is used—to scrape private drafts or sensitive organizational content. Because the vulnerability resides within the plugin's processing logic, it bypasses standard WordPress permission constraints, turning a legitimate feature into a vector for data leakage. The exposure is limited to authenticated users; however, the requirement for an Author-level account is relatively low, making it a viable target for compromised or malicious insider accounts."
}