The vulnerability is a failure to validate the file type of uploads made through the settings import feature of the Rank Math SEO WordPress plugin. An administrator can upload a PHP file, which the server will execute, resulting in full remote code execution on the compromised site. This flaw maps to the Common Weakness Enumeration CWE‑434, representing an unvalidated upload that can lead to code injection.

WordPress sites that have installed the Rank Math SEO plugin in any version earlier than 1.0.280. Any user with administrator privileges who can access the plugin’s settings import function is within the threat surface.

The CVSS score is 7.2 and the EPSS score is not available, but the lack of file type validation in a plugin that runs with site‑wide privileges exposes a serious remote code execution risk. Because the exploit requires administrator access to the WordPress backend, the attack vector is internal via the admin interface. The vulnerability is not listed in CISA’s KEV catalog, but its impact remains critical for operators of affected sites.