Rank Math SEO: PHP Object Injection leading to remote code execution
Summary
The Rank Math SEO plugin for WordPress is affected by PHP Object Injection through unsafe deserialization of untrusted input in the updateMeta REST API endpoint. An authenticated attacker with Contributor rights or higher can inject a PHP object. If a suitable POP chain exists on the site, the attacker can achieve remote code execution by writing a webshell to the uploads directory.
Affected
- Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (WordPress plugin), all versions up to and including 1.0.276
Fixed in
- Unknown. Neither the CVE record nor the sources reviewed name a fixed version for this CVE.
Workaround
- No vendor workaround known.
- Until a fixed version is confirmed: update Rank Math to the newest release, remove or downgrade Contributor-and-above accounts that are not needed, and review recent post and meta changes made by contributors.
Exploitation
- No public proof of concept found at the time of research.
- No known exploitation in the wild.
- Not listed in CISA KEV according to a tracker entry (not checked directly).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS 0.54 % (sources disagree on the figure).
Our recommendation
- Update Rank Math SEO to the newest release from WordPress.org and confirm the fixed version against the Wordfence page.
- Review Contributor-and-above accounts and remove those that are not needed.
- Remove unused plugins and themes to reduce the chance of a usable POP chain.
- Prioritise internet-facing multi-author WordPress sites.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence entry www.wordfence.com
- WordPress plugin changeset 3666725 plugins.trac.wordpress.org
- Rank Math class-sanitize.php (tag 1.0.263) plugins.trac.wordpress.org
- Rank Math class-shared.php (tag 1.0.263) plugins.trac.wordpress.org
- VulDB CVE-2026-1928 vuldb.com
- Vulners NVD record CVE-2026-1928 vulners.com
- WPScan Rank Math SEO plugin wpscan.com
- GitHub CVE tracker issue 3371 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:41.
Original description (NVD)
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.
NVD references (5)
- https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/modules/schema/class-db.php…
- https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/rest/class-sanitize.php#L110
- https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/rest/class-shared.php#L446
- https://plugins.trac.wordpress.org/changeset/3666725/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4395be-7b4c-46b0-be00-7dedc6691f4a?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.