CVE-2026-104753: Rank Math SEO WordPress SQLI Vulnerability

CVE-2026-104753 Overview

CVE-2026-104753 is a SQL injection vulnerability in the Rank Math SEO WordPress plugin versions before 1.0.280. The plugin fails to properly sanitize and escape a parameter before passing it to a SQL query. Authenticated users with high privileges, such as administrators, can inject arbitrary SQL statements through the vulnerable parameter. The flaw is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
An authenticated administrator can execute arbitrary SQL queries against the WordPress database, exposing stored data from the underlying database engine.

Affected Products

Rank Math SEO WordPress plugin versions prior to 1.0.280
WordPress installations with the vulnerable plugin active
Any site where administrator-level accounts are shared or compromised

Discovery Timeline

2026-10-10 - CVE-2026-104753 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104753

Vulnerability Analysis

The Rank Math SEO plugin accepts a user-controlled parameter and incorporates it into a SQL query without proper sanitization or escaping. The missing input handling allows an attacker to break out of the intended query context and append SQL syntax of their choosing. Because the vulnerable code path requires administrator privileges, exploitation is limited to authenticated high-privilege accounts. Successful exploitation can disclose database contents, including WordPress user records and plugin configuration data.

The scope change in the vulnerability metric reflects that SQL execution against the database transcends the plugin's intended security boundary. However, the impact is limited to confidentiality, with no direct integrity or availability consequences recorded for this specific issue.

Root Cause

The root cause is improper neutralization of special characters in a parameter used to build a SQL query. The plugin does not use parameterized queries or $wpdb->prepare() with correct placeholders for the affected input. As a result, SQL metacharacters supplied by an administrator reach the database driver verbatim.

Attack Vector

Exploitation requires an authenticated session with administrator privileges in WordPress. The attacker submits a crafted value through the affected plugin endpoint, embedding SQL syntax such as UNION SELECT clauses or boolean conditions. The injected payload executes within the plugin's query, returning data from arbitrary tables accessible to the WordPress database user.

No verified public proof-of-concept is available at the time of writing. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-104753

Indicators of Compromise

Unexpected SQL syntax (UNION, SELECT, --, 0x) in HTTP request parameters sent to Rank Math SEO plugin endpoints
Database query errors logged by WordPress or MySQL referencing Rank Math plugin files
Administrator sessions originating from unfamiliar IP addresses performing plugin configuration actions

Detection Strategies

Review web server access logs for requests to wp-admin endpoints owned by Rank Math containing SQL keywords in query strings or POST bodies
Enable MySQL general query logging temporarily and look for queries referencing wp_users, wp_usermeta, or wp_options originating from plugin code paths
Deploy a web application firewall ruleset tuned to WordPress plugin SQL injection patterns

Monitoring Recommendations

Alert on administrator account logins from new geographies or ASNs
Monitor file integrity of plugin directories under wp-content/plugins/seo-by-rank-math/
Forward WordPress audit logs into a centralized SIEM for correlation with web traffic telemetry

How to Mitigate CVE-2026-104753

Immediate Actions Required

Upgrade the Rank Math SEO plugin to version 1.0.280 or later on all WordPress sites
Audit the list of administrator accounts and remove or rotate credentials for any unused or shared accounts
Enforce multi-factor authentication for all WordPress administrator logins

Patch Information

Update the Rank Math SEO plugin to version 1.0.280 or newer. The fix adds proper sanitization and escaping of the affected parameter before it is used in SQL queries. Refer to the WPScan Vulnerability Report for the authoritative advisory.

Workarounds

Restrict access to the WordPress admin interface by IP allowlist at the web server or reverse proxy layer
Temporarily deactivate the Rank Math SEO plugin until the patched version can be installed
Reduce the privileges of the MySQL account used by WordPress to the minimum required, limiting the blast radius of SQL injection

bash

# Configuration example: upgrade Rank Math SEO via WP-CLI
wp plugin update seo-by-rank-math --version=1.0.280
wp plugin list --name=seo-by-rank-math --fields=name,status,version