Live › vulnerability › CVE-2026-1928
Go to dashboardThe Rank Math SEO plugin for WordPress deserializes untrusted input in its updateMeta REST API endpoint, letting an authenticated Contributor inject a PHP object. With a usable POP chain present, the attacker can reach remote code execution by writing a webshell to the uploads directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 04:30 UTC. All times on this page are UTC.
Sites running the Rank Math SEO – AI SEO Tools plugin at version 1.0.276 or earlier, where Contributor-level or higher accounts exist. Sites without this plugin or with no low-privilege user accounts are not exposed to this flaw.
No product ranges from the sources yet.
wp plugin get seo-by-rank-math --field=version (plugin slug assumed; confirm)1.0.276; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-1928")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.