Rank Math SEO CVE-2026-1928

Exploitation requires an authenticated account with Contributor-level capability or above (PR:L) and the ability to reach the plugin's updateMeta REST API endpoint, which deserializes attacker-supplied input. Full remote code execution additionally depends on the POP (property-oriented programming) gadget chain the advisory confirms is present, enabling a webshell to be written into the WordPress uploads directory. The principal limiting factor is the Contributor+ authentication requirement: sites that do not permit untrusted user registration at Contributor level or higher substantially reduce the attacker population, though any compromised low-privilege account also satisfies the condition. All versions up to and including 1.0.276 are affected.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only authenticated Contributor-level access (PR:L), with full C:H/I:H/A:H impact because the description explicitly states a usable POP chain turns PHP Object Injection into remote code execution via a webshell written to the uploads directory - so the high confidentiality/integrity/availability ratings are mechanistically justified, not assumed. The vuln.today Decision label is 'this_week', consistent with a reliably exploitable RCE in an extremely widely deployed plugin. Signals are mostly aligned: Wordfence (the reporter) is a credible source, the vulnerability class (CWE-502) is well understood, and the one meaningful limiter is the Contributor+ authentication requirement, which narrows the attacker population to sites allowing untrusted/low-trust user registration or already-compromised low-privilege accounts. Missing/limiting data to note: no EPSS score was supplied, KEV status is not indicated (treat as not KEV-listed), and no confirmed working exploit code was provided - only the Wordfence advisory and WordPress trac source references. The practical risk hinges on whether a site exposes Contributor-level accounts; where it does, this should be treated as near-critical.

An attacker who holds or obtains a Contributor-level (or higher) account on a WordPress site running Rank Math SEO submits crafted serialized data to the updateMeta REST API endpoint, which is deserialized without validation. Because a suitable POP gadget chain is present, the injected PHP object is leveraged to write a webshell into the site's uploads directory, yielding remote code execution. No public exploit identified at time of analysis; the Wordfence advisory and trac source links document the flaw but are not verified working exploit code.