{"id":"CVE-2026-1928","kind":"vulnerability","aliases":["CVE-2026-1928"],"related":[],"title":"Rank Math SEO WordPress plugin: contributor users can inject PHP objects","description":"The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.","summary":"The Rank Math SEO plugin for WordPress deserializes untrusted input in its updateMeta REST API endpoint, letting an authenticated Contributor inject a PHP object. With a usable POP chain present, the attacker can reach remote code execution by writing a webshell to the uploads directory.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-not-installed"],"how_to_check":"- Check the installed Rank Math SEO plugin version in the WordPress admin plugins list or `wp plugin get seo-by-rank-math --field=version` (plugin slug assumed; confirm)\n- Confirm whether the site has user accounts with Contributor role or higher that are not trusted","fix":"- Update Rank Math SEO – AI SEO Tools to a version later than `1.0.276`; the sources do not name the fixed version\n- Until patched, restrict or remove Contributor-level accounts and review the uploads directory for unexpected PHP files","status":"open","published_at":"2026-10-28T04:18:02+00:00","first_seen_at":"2026-10-28T04:30:58+00:00","triaged_at":"2026-10-28T04:32:03+00:00","updated_at":"2026-10-28T04:32:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T04:32:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update Rank Math SEO – AI SEO Tools to a version later than `1.0.276`; the sources do not name the fixed version\n- Until patched, restrict or remove Contributor-level accounts and review the uploads directory for unexpected PHP files","reach":"internet","title":"Rank Math SEO WordPress plugin: contributor users can inject PHP objects","impact":"high","summary":"The Rank Math SEO plugin for WordPress deserializes untrusted input in its updateMeta REST API endpoint, letting an authenticated Contributor inject a PHP object. With a usable POP chain present, the attacker can reach remote code execution by writing a webshell to the uploads directory.","category":"package","nicknames":[],"who_cares":["wordpress","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs code on the server by writing a webshell","analyst_note":"Confirm the fixed version and the exact plugin slug from the NVD and Wordfence entries; the sources only give 'up to and including 1.0.276'.","how_to_check":"- Check the installed Rank Math SEO plugin version in the WordPress admin plugins list or `wp plugin get seo-by-rank-math --field=version` (plugin slug assumed; confirm)\n- Confirm whether the site has user accounts with Contributor role or higher that are not trusted","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-contributor-accounts"],"who_is_affected":"Sites running the Rank Math SEO – AI SEO Tools plugin at version `1.0.276` or earlier, where Contributor-level or higher accounts exist. Sites without this plugin or with no low-privilege user accounts are not exposed to this flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":3406,"output_tokens":647,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1928':14A,17A '-2026':13A,16A '1.0.276':96C 'access':118C 'achiev':136C 'addit':127C 'ai':73C 'allow':133C 'api':38B,106C 'attack':55B,113C,134C 'authent':42B 'chain':52B,132C 'code':59B,138C 'contributor':6A,43B,116C 'contributor-level':115C 'cve':12A,15A 'deseri':31B,98C 'directori':68B,147C 'domin':77C 'endpoint':39B,107C 'execut':60B,139C 'forauthent':112C 'host':22B 'includ':95C 'inject':9A,44B,88C,122C 'input':33B,101C 'let':40B 'level':117C 'make':109C 'math':2A,26B,71C 'object':11A,47B,87C,125C 'packag':18B 'php':10A,19B,46B,86C,124C 'plugin':5A,28B,80C 'pop':51B,131C 'possibl':111C 'presenc':128C 'present':53B 'rank':1A,25B,70C,79C 'reach':57B 'remot':58B,137C 'rest':37B,105C 'self':21B 'self-host':20B 'seo':3A,27B,72C,74C,78C 'tool':75C 'untrust':32B,100C 'updatemeta':36B,104C 'upload':67B,146C 'usabl':50B 'user':7A 'version':91C 'via':97C 'vulner':84C 'webshel':64B,143C 'wordpress':4A,23B,30B,82C 'write':62B,141C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Rank Math SEO – AI SEO Tools plugin at version `1.0.276` or earlier, where Contributor-level or higher accounts exist. Sites without this plugin or with no low-privilege user accounts are not exposed to this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T04:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-1928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1928","severity":null,"published_at":"2026-10-28T04:18:02+00:00","modified_at":"2026-10-28T04:18:02+00:00","first_seen_at":"2026-10-28T04:30:58+00:00","fetched_at":"2026-10-28T04:30:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}