Rank Math SEO CVE-2026-81757

Exploitation requires the attacker to hold a valid WordPress account with at minimum the Author role on the target site (PR:H per CVSS vector). This is the hard prerequisite: unauthenticated or Subscriber/Contributor-level users cannot trigger the vulnerability based on the 'Author RCE' designation in the CVE description. The Rank Math SEO plugin must be installed and active (version <= 1.0.276). No additional non-default configuration is specified as required beyond plugin installation. Exploitation is limited by the need to first obtain Author-level credentials through phishing, credential stuffing, or a separate vulnerability. The unchanged scope (S:U) means the attack impact is confined to the WordPress host's web process - lateral movement to other systems requires additional steps.

The CVSS base score of 7.2 reflects a meaningful but access-gated risk: PR:H (high privileges) is the primary mitigating factor, requiring an adversary to first hold valid Author-level credentials on the target WordPress installation before any exploitation is possible. AC:L indicates no further race conditions or configuration complexity once that credential bar is met, meaning exploitation would be straightforward for a prepared attacker. No EPSS score was provided in the intelligence, and the vulnerability is not listed in CISA KEV, so there is no confirmed evidence of active in-the-wild exploitation. The real-world priority is moderate-to-high for multi-author WordPress environments (newsrooms, content agencies, multi-tenant hosting) where Author accounts are widely issued or where credential theft/phishing is a credible threat model. Single-author or restricted-access sites face lower exposure. CVSS impact metrics (C:H/I:H/A:H) are credible - successful deserialization-to-RCE typically yields full server process compromise.

An attacker who has compromised or legitimately holds a WordPress Author account on a site running Rank Math SEO <= 1.0.276 crafts a malicious PHP serialized object string embedding a known gadget chain and submits it via a plugin-handled input field or REST API endpoint. The plugin's deserialization sink processes the payload without sanitization, instantiating attacker-chosen PHP objects whose magic methods chain together to invoke arbitrary OS commands, resulting in a web shell or reverse shell running as the web server process user.