7.2
High
CVE-2026-104752 The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its…
Description
The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Rank Math SEO 1.0 | earliest → < 1.0.280 | 1.0.280 |
Other CVEs of Rank Math SEO
The 12 CVEs of Rank Math SEO →
CVE-2026-104751
The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its…
5.3
Medium
CVE-2026-104753
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it…
4.1
Medium
CVE-2026-104754
The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting…
3.5
Low
CVE-2026-77788
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the…
4.9
Medium