CVE-2026-1928

HIGH 8.8

Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.

CWE	CWE-502
Vendor	rankmath
Product	rank math seo – ai seo tools to dominate seo rankings
Published	Oct 28, 2026

Stay Ahead of the Next One

Get instant alerts for rankmath rank math seo – ai seo tools to dominate seo rankings

Be the first to know when new high vulnerabilities affecting rankmath rank math seo – ai seo tools to dominate seo rankings are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

rankmath / Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

0 ≤ 1.0.276

References

NVD ↗ CVE.org ↗ EPSS Data ↗

Credits

moochi