CVE-2026-104752

Description

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

References

https://wpscan.com/vulnerability/c7caaf99-5b0f-4935-8875-3a2b9c5ed782/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96118

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3