CVE-2026-1928
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
The Rank Math SEO plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in the updateMeta REST API endpoint. An authenticated attacker with Contributor-level access or higher can inject a PHP object, and the presence of a POP chain allows remote code execution by writing a webshell to the uploads directory.
Risk Assessment
Potential full compromise of the WordPress server through remote code execution, leading to data theft, backdoor installation, and complete site takeover.
Recommendation
Update the Rank Math SEO plugin to a version later than 1.0.276, or if not possible, restrict Contributor-level users and monitor the uploads directory for suspicious files.
Other vulnerabilities in Rank Math SEO WordPress plugin
See all- CVE-2026-77788Medium
The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against. This allows users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.
- CVE-2026-77782Medium
The Rank Math SEO WordPress plugin before version 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata. This allows unauthenticated users to read the content of password-protected posts.
Original NVD description (English source)
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS