Rank Math SEO: PHP object injection remote code execution (CVE-2026-1928)

The Rank Math SEO plugin for WordPress (all versions up to and including 1.0.276) contains a PHP object injection vulnerability in the updateMeta REST API endpoint. The flaw stems from insecure deserialization of untrusted input. Authenticated users with Contributor access or higher can exploit this, and by leveraging an existing Property-Oriented Programming (POP) chain, attackers can write a webshell to the server's uploads directory to execute arbitrary code.

Attack Chain

1. Attacker gains or provisions a WordPress user account with Contributor-level privileges.
2. Attacker crafts a malicious serialized PHP object payload designed to trigger a known POP chain within the application context.
3. Attacker sends a specially crafted POST request to the updateMeta REST API endpoint, injecting the serialized object.
4. The application deserializes the untrusted input, triggering the POP chain.
5. The POP chain executes file system operations to write a malicious PHP script (webshell) into the WordPress uploads directory.
6. Attacker sends an HTTP request to the newly created file in the uploads directory to execute arbitrary code.

Impact

Successful exploitation allows for remote code execution, granting attackers the ability to run arbitrary commands on the underlying web server, potentially leading to full site compromise and persistent access.

Recommendation

• Upgrade the Rank Math SEO plugin to a version released after 1.0.276 immediately.
• Audit WordPress user accounts with Contributor-level access or higher to ensure authorization integrity.
• Scan the server's 'uploads' directory for unauthorized PHP files or suspicious modification timestamps.