Description

Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-28T16:18:30.083Z",
  "pubdate": "2026-08-28T16:18:30.083Z",
  "executiveSummary": "A critical vulnerability exists in Rank Math SEO versions 1.0.276 and below, permitting unauthenticated Remote Code Execution (RCE).\nThe flaw originates from improper input sanitization and inadequate access control within the plugin's REST API endpoints.\nSuccessful exploitation allows an unauthenticated remote attacker to modify arbitrary plugin settings, potentially leading to unauthorized administrative actions and the execution of malicious PHP code.\nThis vulnerability poses a severe risk to WordPress integrity, as attackers can achieve full site compromise by escalating privileges or executing arbitrary server-side logic.\nExploitation requires no prior authentication or administrative privileges, making the plugin highly susceptible to automated mass-exploitation attempts.\nThe impact includes total loss of confidentiality, integrity, and availability of the affected WordPress instance.",
  "technicalDetails": "The vulnerability is primarily rooted in an insecure REST API implementation within the Rank Math SEO plugin, specifically involving the update_settings function.\nThe plugin registers REST API routes that do not sufficiently validate the permissions of the requester, allowing unauthenticated users to invoke functions intended only for administrative use.\nBy targeting specific API endpoints related to plugin configuration, an attacker can manipulate sensitive data stored in the WordPress options table.\nSpecifically, the vulnerability allows an attacker to update the 'rank-math-options' database entry. Through the injection of malicious serialized data or by toggling features that execute server-side code—such as custom schema modifications or redirections—an attacker can trigger RCE.\nThe attack flow proceeds as follows: First, the attacker sends a crafted POST request to the exposed Rank Math REST API endpoint. Because the plugin fails to perform a formal 'permission_callback' check on these specific endpoints, the request is processed by the server.\nSecond, the attacker includes modified parameters within the request body designed to override security-sensitive settings. For instance, by manipulating the settings that handle SEO redirection or custom content injection, the attacker can force the application to interpret malicious input as executable logic.\nThird, the server updates the plugin options in the database. When the WordPress site subsequently loads, the altered settings cause the plugin to process the attacker's payload.\nFourth, the payload executes within the context of the web server user, allowing the attacker to establish persistence, exfiltrate database contents, or deploy a webshell for comprehensive command execution.\nThe affected component is the REST API controller responsible for handling plugin settings management. Since the plugin fails to enforce nonce verification or user role capability checks (e.g., 'manage_options') on these requests, the exposure is critical.\nThis vulnerability is classified as a broken access control issue, leading to potential full system compromise via server-side logic exploitation."
}