Authenticated attackers with Contributor-level access can exploit a PHP Object Injection vulnerability in the Rank Math SEO plugin by sending crafted data to…
Affected component: Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (plugin)
Fixed in: 1.0.277
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 29, 2026. No PowerSEC firewall rule blocks this attack. Update to 1.0.277 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-1928