8.8
High
CVE-2026-1928 The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection…
Description
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Rank Math SEO – AI SEO Tools to Dominate SEO Rankings 1.0 | earliest → 1.0.276 | No fix stated |
Other CVEs of Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
The 10 CVEs of Rank Math SEO – AI SEO Tools to Dominate SEO Rankings →
CVE-2025-12714
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access…
5.3
Medium
CVE-2024-13227
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Stored Cross-Site…
6.4
Medium
CVE-2024-13229
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of…
4.3
Medium
CVE-2024-9314
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection…
7.2
High