CVE-2026-104752: Rank Math SEO WordPress Plugin RCE Flaw

CVE-2026-104752 Overview

CVE-2026-104752 affects the Rank Math SEO plugin for WordPress in versions prior to 1.0.280. The plugin fails to validate the type of files uploaded through its settings import feature. Authenticated users with administrator-level access can upload a PHP file and achieve remote code execution on the underlying web server. The flaw is classified under [CWE-434: Unrestricted Upload of File with Dangerous Type]. Successful exploitation yields full control over the WordPress installation and the hosting environment.

Critical Impact

An authenticated administrator can upload arbitrary PHP code through the settings import function and execute it as the web server user, leading to full site compromise.

Affected Products

• Rank Math SEO WordPress plugin versions prior to 1.0.280
• WordPress sites running the vulnerable plugin with administrator accounts exposed
• Multi-site WordPress deployments where network administrators manage the plugin

Discovery Timeline

• 2026-10-10 - CVE-2026-104752 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104752

Vulnerability Analysis

The Rank Math SEO plugin exposes a settings import feature that accepts uploaded files for restoring configuration data. The import handler does not verify the MIME type, file extension, or content signature of the uploaded file. An attacker holding administrator credentials can submit a .php file disguised as a settings export. Once stored in a web-accessible directory, the file executes when requested via HTTP, giving the attacker a remote code execution primitive inside the WordPress runtime.

The impact extends beyond WordPress itself. Code running under the web server user can read wp-config.php, exfiltrate database credentials, pivot to connected services, and establish persistence through cron jobs, scheduled tasks, or additional web shells.

Root Cause

The vulnerability stems from missing input validation in the settings import routine. The plugin trusts that an administrator will supply a legitimate configuration export, but it does not enforce an allowlist of acceptable file extensions or validate structural content before writing the file to disk. This is a textbook [CWE-434] weakness: unrestricted upload of a file with a dangerous type.

Attack Vector

Exploitation requires authenticated access at the administrator privilege level and network reachability to the WordPress admin interface. An attacker who has phished, brute-forced, or otherwise compromised an administrator account navigates to the Rank Math settings import screen and submits a crafted PHP payload. The attacker then requests the uploaded file through the browser to trigger execution. Because the entry point is a legitimate administrative feature, the request pattern can blend with normal plugin management activity.

See the WPScan Vulnerability Report for additional technical details on the import handler.

Detection Methods for CVE-2026-104752

Indicators of Compromise

• New .php files appearing in WordPress upload directories, especially under paths associated with Rank Math settings imports
• POST requests to the Rank Math settings import endpoint followed by GET requests to unfamiliar PHP files in wp-content/uploads/
• Outbound connections initiated by the web server process to unknown hosts shortly after administrator logins
• Unexpected modifications to wp-config.php, .htaccess, or scheduled task entries

Detection Strategies

• Monitor WordPress audit logs for use of the Rank Math settings import feature, particularly from unusual IP addresses or outside maintenance windows
• Alert on file writes with the .php extension inside directories that normally hold media or configuration backups
• Correlate administrator session events with subsequent process execution originating from the web server user (www-data, apache, nginx)

Monitoring Recommendations

• Enable WordPress activity logging plugins and forward events to a centralized log platform for retention and correlation
• Baseline the file inventory of plugin and upload directories, then alert on deviations
• Track administrator account creation, role changes, and failed logins to identify precursor activity to this exploit chain

How to Mitigate CVE-2026-104752

Immediate Actions Required

• Upgrade the Rank Math SEO plugin to version 1.0.280 or later on all WordPress sites
• Audit administrator accounts, remove unused accounts, and reset credentials for any accounts suspected of compromise
• Inspect wp-content/uploads/ and plugin directories for unauthorized PHP files and remove them
• Rotate database passwords and WordPress salts stored in wp-config.php if compromise is suspected

Patch Information

The vendor fixed the issue in Rank Math SEO version 1.0.280 by enforcing proper validation of uploaded files in the settings import feature. Site operators should apply the update through the WordPress plugin manager or by replacing the plugin directory manually. Confirm the installed version from the WordPress admin dashboard after update.

Workarounds

• Restrict administrator access to trusted IP ranges using web server access controls or a web application firewall
• Require multi-factor authentication for all WordPress administrator accounts to reduce the likelihood of credential-based compromise
• Disable PHP execution within wp-content/uploads/ using web server configuration directives until the plugin is updated
• Temporarily deactivate the Rank Math SEO plugin on sites that cannot be patched immediately

# Example nginx configuration to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}