CVE-2026-81757
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Vulnerability allowing remote code execution (RCE) by a user with the author role in the Rank Math SEO plugin in versions up to and including 1.0.276.
Risk Assessment
A user with author privileges can execute arbitrary code on the server, potentially leading to full compromise of the website and server.
Recommendation
Update the Rank Math SEO plugin to a version newer than 1.0.276 that contains the fix for this vulnerability.
Other vulnerabilities in Rank Math SEO
See all- CVE-2026-77786Low risk· EPSS 3%
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.
- CVE-2026-66702High
Cross Site Scripting (XSS) vulnerability in Rank Math SEO plugin up to version 1.0.274.1, allowing an unauthenticated attacker to inject malicious scripts into pages.
- CVE-2026-34892Medium
There is a broken access control issue in Rank Math SEO versions up to 1.0.271 that may allow unauthorized users to access subscription features.
Original NVD description (English source)
Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.