CVE-2026-1928
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP…
- Risk score
- 63/100
- CVSS
- 8.8 v3.1
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Rank Math SEO plugin for WordPress has a PHP Object Injection vulnerability in all versions up to 1.0.276, allowing authenticated attackers with Contributor-level access to inject a PHP Object and potentially achieve remote code execution.
- Affected
- {'products': ['WordPress'], 'packages': ['Rank Math SEO plugin'], 'versions': ['all versions up to and including 1.0.276']}
- Fix
- Check the linked advisory for a fix; no specific version to upgrade to is given.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
- On your watchlist: php
References
- https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/modules/schema/class-db.php#L66
- https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/rest/class-sanitize.php#L110
- https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/rest/class-shared.php#L446
- https://plugins.trac.wordpress.org/changeset/3666725/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4395be-7b4c-46b0-be00-7dedc6691f4a?source=cve
Original description
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.
Last activity 28 Oct 2026. Patch Forecast updates every hour.