CVE-2026-104752: unknown rank math seo
CVSS: 7.2v3.1HighDeferred
Published 10-10-2026Last modified 10-10-2026
Vulnerability summary
CVE-2026-104752 is a high (CVSS 7.2) vulnerability in unknown rank math seo. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.0.280.
CVSS score
7.2/10
010
High · v3.1 (CVE.org)EPSS score
0.52%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 10-10-2026PublishedVulnerability first disclosed.
- 10-10-2026Last modifiedVulnerability information updated.
Description
The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 7.2Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
10-10-202619-10-2026
EPSS score0.52%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
- rank math seo< 1.0.280
Wordpress1 product
- seo-by-rank-math≤ 1.0.279 (fixed in 1.0.280)
2 vendors · 2 products