CVE-2026-104752 PUBLISHED

Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import

Assigner: WPScan
Reserved: 02.10.2026 Published: 10.10.2026 Updated: 10.10.2026

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

Product Status

Vendor Unknown
Product Rank Math SEO
Versions Default: unaffected
  • affected from 0 to 1.0.280 (excl.)

Credits

  • Karthik Ramakrishnan finder
  • WPScan coordinator

References

Problem Types

  • CWE-434 Unrestricted Upload of File with Dangerous Type CWE