CVE-2026-1928: Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access or higher can exploit it. The attack is performed through the plugin's updateMeta REST API endpoint.
What is the likely impact of successful exploitation?
An attacker can inject a PHP object through unsafe deserialization and use the available POP chain to achieve remote code execution. The described outcome is writing a webshell to the WordPress uploads directory.
Which installations are affected?
Rank Math SEO versions up to and including 1.0.276 are affected. The provided information does not state whether any particular WordPress configuration disables or mitigates the vulnerable REST API endpoint.