CVE-2026-104752: Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import
The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires administrator-level access to the WordPress site. An unauthenticated or lower-privileged user is not identified as able to use the affected settings import feature.
What does a successful exploit allow?
An administrator can upload a PHP file through the settings import feature. This can result in remote code execution on the affected site.
Which installations are affected?
Rank Math SEO versions earlier than 1.0.280 are affected. The provided information does not state whether any particular default configuration changes exposure.
How can I determine whether my site is vulnerable?
Check the installed Rank Math SEO plugin version and whether administrator accounts can access the settings import feature. Versions before 1.0.280 should be treated as affected.