Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings — CVE-2026-1928

What to do now

Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to 1.0.277 or later.

Affected versions

• Everything up to and including 1.0.276

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.

This description is reproduced verbatim from the public vulnerability record.

• https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4395be-7b4c-46b0-be00-7dedc6691f4a?source=api-prod

Part of this record comes from Wordfence Intelligence. Original: https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4395be-7b4c-46b0-be00-7dedc6691f4a
Copyright 2012-2026 Defiant Inc. / Full license text

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.