CVE-2026-81757: Rank Math SEO Plugin RCE Vulnerability

CVE-2026-81757 Overview

CVE-2026-81757 is a Remote Code Execution (RCE) vulnerability in the Rank Math SEO WordPress plugin affecting versions up to and including 1.0.276. The flaw stems from insecure deserialization of untrusted data [CWE-502] and requires an authenticated user with Author-level privileges to exploit. A successful attack lets the adversary execute arbitrary PHP code within the WordPress process, compromising site content, credentials, and hosting infrastructure. The vulnerability was catalogued by Patchstack and published to NVD on 2026-08-28.

Critical Impact
An authenticated Author can achieve full remote code execution on the WordPress host, leading to complete site takeover and lateral movement across shared hosting environments.

Affected Products

Rank Math SEO WordPress plugin versions <= 1.0.276
WordPress sites permitting Author-level account registration or with compromised Author credentials
Multi-site WordPress deployments using the Rank Math SEO plugin

Discovery Timeline

2026-08-28 - CVE-2026-81757 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-81757

Vulnerability Analysis

The vulnerability resides in the Rank Math SEO plugin's handling of serialized PHP data supplied by authenticated users. The plugin passes attacker-controllable input to a deserialization routine without validating the object types being reconstructed. When PHP deserializes a crafted payload, it can trigger magic methods such as __wakeup() or __destruct() on plugin, WordPress core, or third-party classes, chaining them into a POP (Property-Oriented Programming) gadget that executes arbitrary code.

An Author-role account can reach the vulnerable code path through the plugin's authenticated endpoints. Because WordPress runs plugin code with the same privileges as the web server user, successful exploitation grants file write, database access, and command execution capabilities on the host.

Root Cause

The root cause is unsafe deserialization of untrusted data [CWE-502]. The plugin invokes PHP's unserialize() (or an equivalent path) on input reachable by an authenticated Author without an allow-list of permitted classes and without integrity validation of the serialized blob.

Attack Vector

The attack vector is network-based and requires high privileges (Author role). An attacker authenticates to WordPress, then submits a crafted serialized payload to the vulnerable plugin endpoint. The payload references gadget classes present in the WordPress runtime, and deserialization triggers a chain that ends in code execution. No user interaction is required beyond the attacker's own request.

See the Patchstack RCE Vulnerability Report for the technical write-up.

// No verified proof-of-concept code is publicly available.
// Refer to the Patchstack advisory for exploitation specifics.

Detection Methods for CVE-2026-81757

Indicators of Compromise

POST requests from Author accounts to Rank Math SEO plugin endpoints containing serialized PHP payloads (strings beginning with O:, a:, or s: structures)
Unexpected PHP files written under wp-content/uploads/ or plugin directories following Author-authenticated activity
New or modified WordPress admin users, or additions to wp_options (such as active_plugins) shortly after Author logins
Outbound connections from the web server to attacker-controlled hosts originating from PHP worker processes

Detection Strategies

Inspect web server access logs for POST bodies to Rank Math endpoints containing PHP object serialization markers
Alert on file integrity changes within wp-content/plugins/seo-by-rank-math/ and the WordPress core
Correlate Author-level authentication events with process spawns from php-fpm or the web server user
Deploy Web Application Firewall (WAF) rules that inspect authenticated requests for serialized object payloads

Monitoring Recommendations

Enable WordPress audit logging for role changes, plugin installs, and file modifications
Monitor outbound egress from PHP processes and flag connections to non-allowlisted destinations
Track EPSS movement for CVE-2026-81757 and prioritize patching if exploitation likelihood rises

How to Mitigate CVE-2026-81757

Immediate Actions Required

Upgrade Rank Math SEO to a version later than 1.0.276 as soon as the vendor publishes a fixed release
Audit all Author-role and higher accounts, rotating credentials and removing dormant users
Enforce multi-factor authentication (MFA) on every account with Author privileges or above
Review web server and WordPress logs for prior exploitation attempts against Rank Math endpoints

Patch Information

Refer to the Patchstack RCE Vulnerability Report for the current patch status. Apply the vendor-supplied update via the WordPress plugin manager or through your configuration management tooling. Restart PHP workers after the update to clear any cached opcode.

Workarounds

Temporarily deactivate the Rank Math SEO plugin until a patched version is deployed
Restrict access to WordPress administrative endpoints by source IP where feasible
Reduce the pool of Author-level accounts and enforce least-privilege role assignments
Deploy a virtual patch through a WAF that blocks serialized PHP objects in authenticated requests to plugin endpoints

bash

# Disable the plugin via WP-CLI while awaiting a patched release
wp plugin deactivate seo-by-rank-math

# Confirm current plugin version
wp plugin get seo-by-rank-math --field=version