CVE-2026-1928highCWE-502

CVE-2026-1928: fallo de gravedad alta en rankmath Rank Math SEO – AI SEO Tools to…

Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.5%
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
rankmath · Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
CVEs relacionadas — rankmath Rank Math SEO – AI SEO Tools to…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-9161MEDIUMRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and DeleteEPSS 2.1%CVE-2024-9314HIGHRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object InjectionEPSS 0.8%CVE-2024-13227MEDIUMRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math APIEPSS 0.5%CVE-2024-3665MEDIUMRank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'EPSS 0.5%CVE-2024-13229MEDIUMRank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema DeletionEPSS 0.5%CVE-2024-4335MEDIUMRank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%