Rank Math SEO patches a flaw that let code run on the server

On 27 October 2026 Wordfence disclosed a vulnerability in the free Rank Math SEO plugin that can end with someone else's code running on your server (CVE-2026-1928). Every version up to and including 1.0.276 is affected. The fix shipped in 1.0.277 on 26 August, so a site that keeps its plugins up to date probably has it already. Wordfence rates the flaw 8.8 on the CVSS scale, "high". According to wordpress.org, the plugin has more than 4 million active installations.

The attack needs an account on the site with the Contributor role or higher. This is a separate problem from the backdoor in Rank Math PRO 3.0.123 we covered in October. That one was malware that found its way into some copies of the paid plugin. This one is a bug in the code of the free Rank Math SEO from the wordpress.org directory.

How the vulnerability works

Rank Math keeps part of each post's SEO settings in the database, including the structured data (schema) that helps Google understand what is on the page. When someone saves a post in the editor, the plugin sends the changes to its own address in the WordPress REST API, updateMeta. The same address is used to delete a schema from a post.

WordPress stores some of its data in serialised form, as text from which PHP rebuilds arrays and objects. When WordPress reads such a value from the database, it rebuilds it on its own. In version 1.0.276, when deleting a schema, Rank Math takes the value WordPress has already rebuilt and runs it through maybe_unserialize() a second time. If the database holds text that itself looks like a serialised object, that second pass turns it into a real PHP object, of a class the attacker chooses. This is called PHP Object Injection.

The object alone is not a breach. The attacker also needs what is known as a POP chain, a sequence of code already present that the object sets off. According to the CVE record, such a chain lets them write a web shell into the uploads folder, wp-content/uploads. A web shell is a PHP file that runs commands on the server straight from a browser. With one, the attacker has full control of the site.

We compared the code of 1.0.276 and 1.0.277. The new version drops the second rebuild and uses the value as WordPress returns it. The same file also gains a check that the schema entry being changed belongs to the post being edited. The 1.0.277 changelog only carries a general line about strengthened security, with no vulnerability number.

According to the CVE record, Wordfence notified Rank Math on 4 February 2026. As of 29 October, CISA notes in the record that there is no evidence of attacks and that the attack cannot be automated, and it rates the technical impact as total. The record also points to the exact lines of code, which makes life easier for anyone who wants to use the flaw. The CVSS score guide explains what a score of 8.8 means.

Which sites are exposed

A Contributor can write and edit their own posts but cannot publish them. That is why the role is handed out easily, to people you would never give the admin area to. For this vulnerability, though, it is enough. So is any higher role, such as Author, Editor or Shop manager in WooCommerce.

• Sites with several authors. A company blog that a few people write for, or a news site with a team of editors.
• Guest writers. An account opened for one article by an outside author often stays around for years.
• Stores where staff have accounts. WooCommerce's Shop manager role has every right a Contributor has and a great deal more. Accounts of people who no longer work for you carry the same risk.
• Sites with open registration. If "Anyone can register" is ticked under Settings > General and "New User Default Role" is set to Contributor, anyone can create the account they need. The default role is Subscriber, which is not enough for the attack.

WooCommerce gives customers the Customer role, which can only read, just like a Subscriber. It sits below Contributor, so an ordinary customer account is not enough. The attacker does not have to be someone on your team, though. A password for one of these accounts, leaked from another site or guessed, will do.

Is your site affected?

You can see the version under Plugins > Installed Plugins. In cPanel's Terminal, the command below lists the Rank Math plugins and their versions. The WP-CLI guide explains how to work with WP-CLI.

# cPanel > Terminal, in the site's folder
# Read-only. Lists the Rank Math plugins and their versions.
wp plugin list --fields=name,status,version \
  --skip-plugins --skip-themes | grep -i rank

The free plugin is the line seo-by-rank-math. If its version is 1.0.277 or later, this vulnerability is closed. Rank Math PRO only works alongside the free plugin, so a site running PRO also has the vulnerable code if the free plugin has not been updated.

The next command shows which users have a role from Contributor up and whether registration is open. It changes nothing either.

# cPanel > Terminal, in the site's folder
# Read-only. Users with a role from Contributor up.
for r in contributor author editor shop_manager; do
  echo "== $r"
  wp user list --role="$r" \
    --fields=ID,user_login,user_email,user_registered \
    --skip-plugins --skip-themes
done
wp option get users_can_register --skip-plugins --skip-themes
wp option get default_role --skip-plugins --skip-themes

Go through every name on the list and ask whether that person still writes for or works on the site. If the second-to-last command returns 1, registration is open, and the last one shows the role new users get. Administrators are not on the list but are enough for the attack too, so check them separately with wp user list --role=administrator.

What to do

1. Back up the files and the database, as described in the backup guide. Then update Rank Math SEO from Dashboard > Updates to 1.0.277 or later, ideally to the latest, 1.0.281 from 3 November. If you also run PRO, update the free plugin first. The guide to updating plugins shows how to update without surprises.
2. Delete the accounts nobody uses and switch people who no longer write to Subscriber. If you are not sure the others have strong passwords, ask them to change them.
3. If registration is open with the Contributor role, close it or set "New User Default Role" to Subscriber under Settings > General.
4. Look for PHP files in the uploads folder. It should only hold images and documents.

The command below lists the PHP files in wp-content/uploads with their date and size. It only reads.

# cPanel > Terminal, in the site's folder
# Read-only. PHP files in the uploads folder.
find wp-content/uploads -type f \
  \( -name "*.php" -o -name "*.phtml" \) -ls

Some plugins put an empty index.php there so the folder's contents cannot be listed, and that is normal. Any other PHP file is cause for alarm. If you find one, work through the guide for a hacked site or turn to emergency help. An empty result is a good sign, but it does not prove the site is clean.

What we do

With vulnerability (CVE) monitoring we track what is installed on your site and match it against the vulnerability (CVE) databases every day. As soon as a vulnerability appears in something you use, we send you an alert and update, trying the update on a copy in staging first. Your site can be hosted anywhere. If you would like us to add it, write to us through the inquiry form.

Sources

• CVE.org, CVE-2026-1928
• NVD, CVE-2026-1928
• Wordfence, Rank Math SEO <= 1.0.276, Authenticated (Contributor+) PHP Object Injection to Remote Code Execution
• WordPress.org, Rank Math SEO
• WordPress.org Plugin SVN, Rank Math SEO 1.0.277, readme.txt
• WordPress.org Plugin SVN, Rank Math SEO 1.0.276, class-shared.php
• WordPress.org Plugin SVN, Rank Math SEO 1.0.277, class-shared.php
• WordPress Developer Resources, get_metadata_by_mid()
• WordPress.org Plugin SVN, WooCommerce, class-wc-install.php
• Rank Math, Should I Delete the Free Version After Installing Rank Math PRO?
• WordPress.org, Roles and Capabilities
• WP-CLI, wp plugin list
• WP-CLI, wp user list
• WP-CLI, wp option get