Rank Math SEO EUVD-2026-96118

Exploitation requires that the attacker already possess WordPress administrator-level access and reach the Rank Math SEO settings import feature, which is the exact function that fails to validate uploaded file type. The limiting factors are significant: it is not remotely reachable by an unauthenticated attacker (CVSS PR:H confirms authentication at administrator level), so an external attacker must first compromise or obtain admin credentials; the affected product is any WordPress site running Rank Math SEO before version 1.0.280. There is no user-interaction requirement (UI:N) once admin access is held, and no special non-default plugin configuration is described - the import feature is a standard part of the plugin.

This is a high-severity-looking but comparatively low-real-risk issue once the privilege requirement is accounted for. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) confirms network reachability with low complexity and no user interaction, but PR:H means the attacker must already hold administrator-level access to the WordPress site before exploitation - consistent with the description ('users with administrator-level access'). That single factor dominates the real-world assessment: a WordPress administrator can already install plugins and themes and thus already has a path to code execution, so this vulnerability mainly collapses a privilege boundary that is largely nominal in default WordPress. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there are no signals of active or imminent exploitation. There is no SSVC decision data supplied. No signals conflict with one another here (CVSS network vector is compatible with the import-via-admin-dashboard description); the main caveat is that the high CVSS could overstate urgency relative to the admin precondition. Overall: patch in the normal maintenance cycle, prioritize if administrator credentials are weakly protected or shared.

An attacker who has already obtained WordPress administrator access (via stolen credentials, a compromised admin account, or a separate privilege escalation) navigates to Rank Math SEO's settings import feature and uploads a crafted PHP file disguised as an import file. Because the plugin does not correctly validate the uploaded file type, the PHP file lands in a web-accessible location and is executed when requested, yielding remote code execution on the host. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means exploitation is straightforward once admin access is held.