CVE-2026-1928
validatedZero produced an exploit or a check.GHSA-f7v4-wpwr-74r2 ↗EUVD-2026-111576 ↗
description
Rank Math SEO for WordPress versions through 1.0.276 mishandle serialized input supplied to a REST API handler. An authenticated user with Contributor-level access or greater may be able to trigger object injection and, where the required application code chain is present, execute code on the site.
mitigation
Restrict Contributor and higher roles to trusted users, disable unnecessary REST API access, and monitor the uploads directory for unexpected files. Update Rank Math SEO promptly when the vendor publishes a corrected release; no fixed version is recorded in the advisory.
outcome
Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-28 03:42Zcve_org: trigger signal, started the run
- 2026-10-28 04:04Z
this entry in the feed
GET /api/v1/feed/CVE-2026-1928
{ "etk_id": "ETK-2026-2828", "cve_id": "CVE-2026-1928", "display_id": "CVE-2026-1928", "ghsa_id": "GHSA-f7v4-wpwr-74r2", "euvd_id": "EUVD-2026-111576", "status": "published", "anchor_state": "anchored", "title": "PHP object injection in Rank Math SEO for WordPress", "summary": "Rank Math SEO for WordPress versions through 1.0.276 mishandle serialized input supplied to a REST API handler. An authenticated user with Contributor-level access or greater may be able to trigger object injection and, where the required application code chain is present, execute code on the site.", "mitigation": "Restrict Contributor and higher roles to trusted users, disable unnecessary REST API access, and monitor the uploads directory for unexpected files. Update Rank Math SEO promptly when the vendor publishes a corrected release; no fixed version is recorded in the advisory.", "vendor": "rankmath", "product": "Rank Math SEO – AI SEO Tools to Dominate SEO Rankings", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 1.0.276" ], "ecosystem": null, "fixed_versions": [], "package_name": "Rank Math SEO – AI SEO Tools to Dominate SEO Rankings", "purl": null } ], "cwes": [ 502 ], "cvss_score": 8.8, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "upstream", "exploit": false, "pipeline_minutes": 0.0099556, "t0_at": "2026-10-28T03:42:54.378000+00:00", "signals": { "check": { "at": "2026-10-28T04:04:20.971487+00:00", "days": 0.01489112832175926, "is_lower_bound": false, "measured_at": "2026-10-28T03:42:54.378000+00:00", "url": null }, "trigger_signal": { "at": "2026-10-28T03:42:54.378000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-28T03:42:54.378000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1928" } } }
published 2026-10-28 04:03Z
last change 2026-10-28 07:35Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.