PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-104753 Rank Math CVE debrief

The Rank Math SEO WordPress plugin before 1.0.280 is vulnerable to SQL injection attacks through the 'per_page' parameter. This vulnerability allows high-privilege users, such as administrators, to perform SQL injection attacks, potentially leading to unauthorized database access and data tampering. The vulnerability exists because the plugin does not properly sanitize and escape the 'per_page' parameter before using it in a SQL query. To address this vulnerability, administrators and security teams should assess their exposure, verify the version of the plugin, and apply updates if necessary. This involves reviewing the current version of the Rank Math SEO plugin, comparing it to

Vendor
Rank Math
Product
Rank Math SEO
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-10
Original CVE updated
2026-10-10
Advisory published
2026-10-10
Advisory updated
2026-10-10

Who should care

Administrators and security teams responsible for WordPress installations with the Rank Math SEO plugin should be aware of this vulnerability. They should assess their exposure, verify the version of the plugin, and apply updates if necessary to prevent potential unauthorized database access and data tampering. This includes reviewing the current version of the Rank Math SEO plugin, comparing it to the latest version

Why it matters

CVE-2026-104753 is a SQL injection vulnerability in the Rank Math SEO WordPress plugin. Administrators and security teams should assess exposure, verify versions, and apply updates if necessary to prevent potential unauthorized database access and data tampering.

  • Potential for unauthorized database access
  • Risk of data tampering or extraction
  • Need for version verification and updates
  • Importance of monitoring SQL query activity

Technical summary

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitize and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks. This vulnerability can lead to potential unauthorized database access and data tampering. The plugin's failure to sanitize the 'per_page' parameter creates a window for attackers to inject malicious SQL code, which can be executed with the privileges of the user performing the action. To mitigate this vulnerability, it is essential to assess the

Defensive priority

Assess exposure and apply updates

Recommended defensive actions

  • Assess exposure of Rank Math SEO installations
  • Verify version and apply updates if necessary
  • Monitor for suspicious SQL queries

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about this vulnerability. A source reference from WPScan offers additional technical details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-104753 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-104753

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-104753 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-104753

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104753.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://wpscan.com/vulnerability/74d473c2-ced1-47f2-b530-dcd6ea003760/

    Supplemental source - exploit, vdb-entry, technical-description

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.