Advisory · CVE-2026-1928
Rank Math SEO object injection lets a contributor-level account reach remote code execution
The Rank Math SEO plugin for WordPress, in versions up to and including 1.0.276, deserializes untrusted input in the updateMeta REST API endpoint, so a contributor-level attacker can inject a PHP object and, through the chain in the record, write a webshell to the uploads directory. CVSS 3.1 8.8.
- Vendor
- Rank Math
- Product
- Rank Math SEO
- Identifier / CWE
- CVE-2026-1928
CWE-502 - Action timing
- Immediate
Explain it like I’m five
A low-level logged-in account can send the plugin a rigged serialized object through its REST endpoint. The plugin unpacks the object, the rigged chain fires, and the attacker ends up with a webshell on the site.
- 01Contributor account signs in
The attacker holds any authenticated account at Contributor level or above on a site running Rank Math SEO up to 1.0.276.
- 02Crafted request sent
The attacker sends a request to the updateMeta REST API endpoint carrying serialized data they control.
- 03Object is deserialized
The endpoint deserializes the untrusted input, injecting a PHP object into request handling.
- 04Chain fires
Per the record, the POP chain present allows the injected object to write a webshell to the uploads directory.
- 05Code execution gained
The attacker requests the webshell and runs code on the server in the site context.
What happened
Wordfence disclosed CVE-2026-1928, published in NVD on October 28, 2026 and rated high at CVSS 3.1 8.8: the Rank Math SEO plugin for WordPress is vulnerable to PHP object injection (CWE-502) in all versions up to and including 1.0.276, via deserialization of untrusted input in the updateMeta REST API endpoint. Per the record, authenticated attackers with Contributor-level access and above can inject a PHP object, and the additional presence of a POP chain allows them to achieve remote code execution by writing a webshell to the uploads directory.
The Patchstack database entry for this flaw states that updating to version 1.0.277 or later resolves the vulnerability; the affected range stated in the NVD record ends at 1.0.276. Rank Math is widely deployed: the vendor plugin page on WordPress.org states that over 4 million WordPress websites use Rank Math.
What to do
- Inventory WordPress sites running the Rank Math SEO plugin and note the version of each, including staging and client sites.
- Update Rank Math SEO to version 1.0.277 or later on every site running 1.0.276 or earlier, and verify the deployed version afterwards.
- Until a site is updated, consider disabling open user registration and removing contributor accounts you do not recognize, because any low-privilege account can attempt this.
- Check the uploads directory and the rest of the site for PHP files that do not belong there, new or unexpected administrator users, and recent logins from unfamiliar addresses.
- If a webshell or other takeover indicator is found, reset administrator passwords, rotate WordPress salts and any credentials reachable from the site, and scan the site for added files or content.
- Check whether Rank Math PRO or other add-ons on the site are also current, and update those packages as well.
Management note
Four million sites run this plugin, and the attack needs only a contributor account, the kind of account many sites hand out for guest posts. Treat the update as urgent on any site with open registration or outside contributors, and treat an unfamiliar PHP file in uploads as a compromise indicator.