VulnSocial

CVE-2026-104752

LOWCVSS 7.2 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-10-17: 210-17
Referenced assets1 URL
Full discourse2 posts
  • Ahmad Raza | MERN Stack Developer@Ahmad365Raza

    Running Rank Math on your store? Quick checklist for today: update to 1.0.280 or later, review who has Administrator access, remove accounts you don't recognize, and turn on 2FA for every admin. https://www.fused.com/wordpress-vulnerabilities/plugins/rank-math-seo/cve-2026-104752/ #WordPress #ecommerce #CyberSecurity

    0001040
    18 followersView on X
  • Ahmad Raza | MERN Stack Developer@Ahmad365Raza

    Rank Math SEO security update: CVE-2026-104752 (CVSS 7.2) lets an admin-level account upload a PHP file via the settings import feature and run code on the server. Affects versions before 1.0.280, fixed in 1.0.280. https://www.fused.com/wordpress-vulnerabilities/plugins/rank-math-seo/cve-2026-104752/ #WordPress #WebSecurity #SEO

    0000036
    18 followersView on X

Explore more

Back to dashboard