Rank Math SEO CVE-2026-104753

Exploitation requires the attacker to be authenticated as a high-privilege user - specifically an administrator, as the description states - on a WordPress site running Rank Math SEO before 1.0.280. The concrete trigger is supplying attacker-controlled input in the affected plugin parameter that is not sanitized or escaped before being used in a SQL query. The decisive limiting factor is the administrator privilege requirement (CVSS PR:H): because administrators already have broad control over the site and database, realistic risk is confined to scenarios involving compromised admin accounts, privilege-separation bypass, or multi-admin environments where SQL-level access exceeds an admin's intended application permissions. No user interaction by a victim is required.

This is a low-priority vulnerability despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) scores only 4.1, and the single most important signal is PR:H: the flaw requires an attacker to already hold high-privilege (administrator) access to the WordPress site, which the description confirms explicitly. An administrator can already read and alter site data through legitimate means, so a self-service SQL injection adds marginal attack surface - the scope-change flag (S:C) and low confidentiality impact (C:L) reflect only that raw DB access may slightly exceed the WordPress application boundary. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent (high-privilege, low-impact, no exploitation evidence) rather than conflicting; the primary caveat is that EPSS data is absent, so exploitation probability cannot be quantified from this input. A vendor patch is available, making remediation straightforward.

An attacker who has already compromised or legitimately holds a WordPress administrator account on a site running Rank Math SEO below 1.0.280 submits a crafted value in the vulnerable plugin parameter, which is concatenated unsanitized into a backend SQL query. This lets them execute arbitrary SQL against the WordPress database. No public proof-of-concept exploit is referenced in the available data.