The Rank Math SEO plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 1.0.276. The flaw arises from deserializing untrusted input within the updateMeta REST API endpoint, enabling an authenticated user with Contributor level or higher to inject a malicious PHP object. If the attacker also supplies an appropriate POP chain, the injection leads to remote code execution by writing a webshell into the uploads directory.

Any WordPress site running Rank Math SEO version 1.0.276 or earlier is affected. Attackers only need Contributor or higher access to the site to exploit the vulnerability.

The CVSS score of 8.8 indicates a high severity. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the nature of the flaw allows an authenticated actor to execute arbitrary code on the host. The most likely attack vector is through an authenticated REST API call to the updateMeta endpoint, where an attacker sends a serialized object payload that is processed without proper validation.