Vulnerability Description
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/include
- https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/include
- https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/include
- https://plugins.trac.wordpress.org/changeset/3666725/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4395be-7b4c-46b0-be0
FAQ
What is CVE-2026-1928?
CVE-2026-1928 is a vulnerability with a CVSS score of 8.8 (HIGH). The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted inpu...
How severe is CVE-2026-1928?
CVE-2026-1928 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-1928?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.