CVE-2026-1928 in Rank Math SEO

Summary

CVE-2026-1928 is a PHP Object Injection vulnerability affecting the Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin. This vulnerability allows authenticated attackers with Contributor-level access or higher to achieve remote code execution. The issue is resolved in Rank Math SEO plugin version 1.0.277 and later. A Proof-of-Concept (PoC) for this vulnerability is publicly available.

Affected and patched versions

• Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (plugin seo-by-rank-math): affected 1.0.276 and earlier; fixed in 1.0.277

Is my site vulnerable?

To determine if your WordPress site is vulnerable to CVE-2026-1928, you need to check the installed version of the Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin. This vulnerability affects all versions up to, and including, 1.0.276. Sites running version 1.0.277 or later are not affected by this specific vulnerability.

You can check your plugin version through the WordPress admin dashboard:

1. Log in to your WordPress admin area.

2. Navigate to the "Plugins" section from the left-hand menu.

3. Locate "Rank Math SEO – AI SEO Tools to Dominate SEO Rankings" in the list of installed plugins.

4. The version number is displayed directly below the plugin's name.

If the displayed version is 1.0.276 or earlier, your site is vulnerable. If the version is 1.0.277 or higher, your site has the patch for this vulnerability.

What an attacker actually does

An attacker exploits CVE-2026-1928 by targeting a PHP Object Injection vulnerability within the Rank Math SEO plugin. This vulnerability exists in the updateMeta REST API endpoint, where the plugin deserializes untrusted input. Deserialization is the process of reconstructing a PHP object from a string of data. When this process is performed on data that an attacker can control, it can lead to the injection of malicious PHP objects.

To initiate the attack, an authenticated user with at least Contributor-level access is required. The attacker crafts a malicious serialized PHP object and sends it to the updateMeta REST API endpoint. The plugin then attempts to deserialize this untrusted input. The presence of a Property-Oriented Programming (POP) chain within the plugin's codebase allows the injected PHP object to trigger a sequence of unintended actions.

This chain of actions ultimately enables the attacker to achieve remote code execution. Specifically, the attacker can write a webshell to the site's uploads directory. A webshell is a malicious script, typically a PHP file, that provides a remote interface for an attacker to execute arbitrary commands on the compromised server. Once the webshell is in place, the attacker gains persistent control over the affected WordPress site, allowing them to perform further malicious activities such as data exfiltration, defacement, or injecting malware.

How to detect a compromise

Detecting a compromise related to CVE-2026-1928 involves looking for indicators of remote code execution and the presence of webshells. Since the attack involves writing a webshell to the uploads directory, a primary detection method is to scan for unexpected or suspicious files in this location.

File System Indicators:

• Unexpected files in the uploads directory: Attackers often place webshells in directories that are typically writable by the web server, such as wp-content/uploads/. Look for PHP files (.php, .phtml, .php5, etc.) in these directories that do not belong to legitimate WordPress uploads. Webshells may have obfuscated names or appear as seemingly innocuous files.

• Recently modified files: Check for PHP files that have been recently created or modified, especially if these changes do not correspond to legitimate updates or content additions.

• Suspicious file content: Examine the content of any suspicious PHP files. Webshells frequently contain functions like eval(), base64_decode(), shell_exec(), system(), passthru(), exec(), proc_open(), or assert() used with user-supplied input. They might also include large blocks of encoded or compressed data.

Log Analysis:

• Web server access logs: Review your web server access logs (e.g., Apache access.log, Nginx access.log) for unusual activity. Look for:

  • Requests to the updateMeta REST API endpoint (/wp-json/rankmath/v1/updateMeta or similar) with unusually large or malformed POST data, especially from authenticated users.

  • Subsequent requests to newly created PHP files within the wp-content/uploads/ directory, which would indicate an attacker activating a webshell.

  • Unusual HTTP status codes (e.g., 500 errors) following requests to the updateMeta endpoint, which could indicate a failed exploitation attempt.

• WordPress debug logs: If WordPress debugging is enabled, check wp-content/debug.log for any PHP errors or warnings related to deserialization or unexpected object handling around the time of a suspected compromise.

Command-line Detection (SSH access required): You can use command-line tools to search for suspicious files.

• Find recently modified PHP files in uploads:

  find /path/to/your/wordpress/wp-content/uploads -name "*.php*" -mtime -7 -ls

  (This command finds PHP files modified in the last 7 days. Adjust -mtime as needed.)

• Search for common webshell functions within PHP files:

  grep -r -E "eval\(|base64_decode\(|shell_exec\(|system\(|passthru\(|exec\(|assert\(" /path/to/your/wordpress/wp-content/uploads

  This command recursively searches for common webshell functions within the uploads directory. Be aware that legitimate plugins might also use some of these functions, so manual review of findings is necessary.

• Using WP-CLI (if installed):

  wp plugin list --field=version rank-math

  This command will show the installed version of the Rank Math plugin, confirming if the vulnerable version is present.

If you identify any of these indicators, it suggests a potential compromise. Further investigation and incident response procedures would be necessary.

How to fix

To address CVE-2026-1928, follow these steps:

1. Backup your site: Before making any changes, create a complete backup of your WordPress site's files and database. This ensures you can restore your site if any issues arise during the update process.

2. Check for compromise: Before updating, perform the detection steps outlined above to determine if your site has already been compromised. If a compromise is detected, you should isolate the site, remove any malicious files, and investigate the extent of the breach. Simply updating the plugin will not remove existing webshells or other malicious payloads.

3. Update the Rank Math SEO plugin: Update the Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin to version 1.0.277 or later.

   • Log in to your WordPress admin area.

   • Navigate to "Plugins" > "Installed Plugins".

   • Locate "Rank Math SEO – AI SEO Tools to Dominate SEO Rankings".

   • If an update is available, a notice will appear below the plugin name. Click "Update Now".

   • If no update notice appears, and your version is older than 1.0.277, you may need to manually update the plugin or check for compatibility issues.

4. Verify the update: After updating, confirm that the plugin's version number is 1.0.277 or higher in the "Installed Plugins" list.

5. Monitor your site: Continue to monitor your site's logs and file system for any unusual activity, especially if a compromise was detected prior to the update.

Timeline

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-1928

• https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4395be-7b4c-46b0-be00-7dedc6691f4a

• https://wordpress.org/plugins/seo-by-rank-math/

• https://www.cve.org/CVERecord?id=CVE-2026-1928

• https://nvd.nist.gov/vuln/detail/cve-2026-101928