CVE-2026-104752: Unknown Rank Math Seo

High severity, CVSS 7.2. EPSS: 0.2% chance of exploitation in the next 30 days.

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

Affected products

• Unknown Rank Math Seo: before 1.0.280 (fixed in 1.0.280)

Published 2026-10-10. Last modified 2026-10-10.