CVE-2026-1928: Rank Math SEO PHP Object Injection Leads to Remote Code Execution
CVE-2026-1928 is a high-severity (CVSS 8.8) PHP Object Injection flaw in the Rank Math SEO WordPress plugin, versions 1.0.276 and earlier. Any user with Contributor access can abuse the updateMeta REST API endpoint to inject a serialized object, write a webshell and take over the site. Here is how to detect and fix it.
6 min read
