CVE-2026-1928

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.

• CWE-502

• https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/modules/schema/class-db.php#L66
• https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/rest/class-sanitize.php#L110
• https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/rest/class-shared.php#L446
• https://plugins.trac.wordpress.org/changeset/3666725/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4395be-7b4c-46b0-be00-7dedc6691f4a?source=cve

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19270A security flaw has been discovered in Hulupeep mcp-ui-probe…5.3
• CVE-2026-19271Improper Neutralization of Special Elements used in an LDAP …7.5
• CVE-2026-19273IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6_2, 6.2.1…5.4
• CVE-2026-19274IBM Observability with Instana (Agent) Build 1.0.303 through…9.6
• CVE-2026-19278A flaw was found in StackRox/RHACS Central's Auth Machine-to…6.8
• CVE-2026-19279A vulnerability was identified in MIMICLab mcp-pdf-vision 1.…5.3
• CVE-2026-19280IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service…5.2
• CVE-2026-19281A security flaw has been discovered in adolfosalasgomez3011 …5.3
• CVE-2026-19282A weakness has been identified in andreahaku llm_memory_mcp …5.3
• CVE-2026-19283IBM Observability with Instana (Agent) Build 1.0.303 through…7.7
• CVE-2026-19284A security vulnerability has been detected in MauricioMilano…5.3
• CVE-2026-19285A vulnerability was detected in aaronsb memory-graph up to 5…5.3