{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/rank-math-seo--1.0.276/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rankmath:seo:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-1928"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rank Math SEO (\u003c= 1.0.276)"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin-vulnerability","php-injection","rce"],"_cs_type":"advisory","_cs_vendors":["Rank Math"],"content_html":"\u003cp\u003eThe Rank Math SEO plugin for WordPress (all versions up to and including 1.0.276) contains a PHP object injection vulnerability in the updateMeta REST API endpoint. The flaw stems from insecure deserialization of untrusted input. Authenticated users with Contributor access or higher can exploit this, and by leveraging an existing Property-Oriented Programming (POP) chain, attackers can write a webshell to the server's uploads directory to execute arbitrary code.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains or provisions a WordPress user account with Contributor-level privileges.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious serialized PHP object payload designed to trigger a known POP chain within the application context.\u003c/li\u003e\n\u003cli\u003eAttacker sends a specially crafted POST request to the updateMeta REST API endpoint, injecting the serialized object.\u003c/li\u003e\n\u003cli\u003eThe application deserializes the untrusted input, triggering the POP chain.\u003c/li\u003e\n\u003cli\u003eThe POP chain executes file system operations to write a malicious PHP script (webshell) into the WordPress uploads directory.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP request to the newly created file in the uploads directory to execute arbitrary code.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for remote code execution, granting attackers the ability to run arbitrary commands on the underlying web server, potentially leading to full site compromise and persistent access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Rank Math SEO plugin to a version released after 1.0.276 immediately.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user accounts with Contributor-level access or higher to ensure authorization integrity.\u003c/li\u003e\n\u003cli\u003eScan the server's 'uploads' directory for unauthorized PHP files or suspicious modification timestamps.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T06:27:11Z","date_published":"2026-10-28T06:27:11Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rank-math-cve-2026-1928/","summary":"The Rank Math SEO plugin for WordPress is vulnerable to PHP object injection via the updateMeta REST API endpoint, allowing authenticated contributors to achieve remote code execution through POP chain exploitation.","title":"Rank Math SEO: PHP object injection remote code execution (CVE-2026-1928)","url":"https://feed.craftedsignal.io/briefs/2026-10-rank-math-cve-2026-1928/"}],"language":"en","title":"CraftedSignal Threat Feed - Rank Math SEO (\u003c= 1.0.276)","version":"https://jsonfeed.org/version/1.1"}