WordPress plugin
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 36 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High8
- Medium26
- Low1
All Rank Math SEO – AI SEO Tools to Dominate SEO Rankings vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Authenticated (Contributor+) PHP Object Injection to Remote Code Execution ≤1.0.276Update to 1.0.277 | CVE-2026-1928 | |
| High7.2 | Authenticated (Administrator+) Arbitrary File Upload ≤1.0.279Update to 1.0.280 | CVE-2026-104752 | |
| High8.8 | Authenticated (Author+) Remote Code Execution ≤1.0.276Update to 1.0.277 | CVE-2026-81757 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤1.0.274.1Update to 1.0.275 | CVE-2026-66702 | |
| High7.2 | .htaccess File Manipulation to Remote Code Execution ≤1.0.231Update to 1.0.232 | CVE-2024-11620 | |
| High7.2 | Authenticated (Administrator+) PHP Object Injection ≤1.0.228Update to 1.0.229 | CVE-2024-9314 | |
| Critical9.8 | Privilege Escalation via Unprotected REST API Endpoint <1.0.41Update to 1.0.41 | CVE-2020-11514 | |
| High7.4 | Redirect Creation via Unprotected REST API Endpoint ≤1.0.40Update to 1.0.41 | CVE-2020-11515 | |
| High7.2 | Cross-Site Scripting ≤1.0.26Update to 1.0.27 | — |
- High8.8Authenticated (Contributor+) PHP Object Injection to Remote Code Execution
≤1.0.276Update to 1.0.277
- High7.2Authenticated (Administrator+) Arbitrary File Upload
≤1.0.279Update to 1.0.280
- High8.8Authenticated (Author+) Remote Code Execution
≤1.0.276Update to 1.0.277
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.0.274.1Update to 1.0.275
- High7.2.htaccess File Manipulation to Remote Code Execution
≤1.0.231Update to 1.0.232
- High7.2Authenticated (Administrator+) PHP Object Injection
≤1.0.228Update to 1.0.229
- Critical9.8Privilege Escalation via Unprotected REST API Endpoint
<1.0.41Update to 1.0.41
- High7.4Redirect Creation via Unprotected REST API Endpoint
≤1.0.40Update to 1.0.41
- High7.2Cross-Site Scripting
≤1.0.26Update to 1.0.27
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: common questions
Does Rank Math SEO – AI SEO Tools to Dominate SEO Rankings have known vulnerabilities?
Yes. VulnCrest Radar lists 36 known vulnerabilities in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: 1 critical, 8 high, 26 medium, 1 low. None are known to affect version null.
How do I check which version of Rank Math SEO – AI SEO Tools to Dominate SEO Rankings I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Rank Math SEO – AI SEO Tools to Dominate SEO Rankings vulnerability?
CVE-2026-1928, published Oct 27, 2026: Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution. Severity: High (CVSS 8.8).
Is any Rank Math SEO – AI SEO Tools to Dominate SEO Rankings vulnerability listed in CISA KEV?
No. None of the known Rank Math SEO – AI SEO Tools to Dominate SEO Rankings vulnerabilities is currently listed in the CISA KEV catalog.