---
id: CVE-2026-104752
title: >-
  The Rank Math SEO  WordPress plugin before 1.0.280 does not correctly validate
  the type of a file uploaded through its settings import feature, allowing
  users with administrator-level access to upload a PHP file and achieve remote
  code e…
summary: >-
  The Rank Math SEO  WordPress plugin before 1.0.280 does not correctly validate
  the type of a file uploaded through its settings import feature, allowing
  users with administrator-level access to upload a PHP file and achieve remote
  code e…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-434
published: '2026-10-10'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:36:00.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104752'
references:
  - url: 'https://wpscan.com/vulnerability/c7caaf99-5b0f-4935-8875-3a2b9c5ed782/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00506
epssPercentile: 0.43025
ingestedAt: '2026-10-10T06:24:42.859Z'
product: Rank Math SEO
affected:
  - rank_math_seo < 1.0.280
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-10T12:04:56.696674Z'
---

## Overview

The Rank Math SEO  WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.