---
id: "CVE-2026-1928"
kind: "vulnerability"
aliases: ["CVE-2026-1928"]
title: "Rank Math SEO WordPress plugin: contributor users can inject PHP objects"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "wordpress"]
not_affected_if: ["no-contributor-accounts", "plugin-not-installed"]
published_at: "2026-10-28T04:18:02+00:00"
first_seen_at: "2026-10-28T04:30:58+00:00"
updated_at: "2026-10-28T04:32:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1928", "first_seen_at": "2026-10-28T04:30:58+00:00"}]
---

# Rank Math SEO WordPress plugin: contributor users can inject PHP objects

The Rank Math SEO plugin for WordPress deserializes untrusted input in its updateMeta REST API endpoint, letting an authenticated Contributor inject a PHP object. With a usable POP chain present, the attacker can reach remote code execution by writing a webshell to the uploads directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Rank Math SEO plugin version in the WordPress admin plugins list or `wp plugin get seo-by-rank-math --field=version` (plugin slug assumed; confirm)
- Confirm whether the site has user accounts with Contributor role or higher that are not trusted

## Fix

- Update Rank Math SEO – AI SEO Tools to a version later than `1.0.276`; the sources do not name the fixed version
- Until patched, restrict or remove Contributor-level accounts and review the uploads directory for unexpected PHP files

## Timeline

- 2026-10-28T04:30:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-1928

## From the sources

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_