# CVE-2026-104753: Rank Math SEO SQL injection in per_page parameter

Source: https://junglewise.ai/threats/cve-2026-104753-the-rank-math-seo-wordpress-plugin-before-1-0-280-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-104753 · Severity: medium · CVSS 4.1 · Published 2026-10-10

Rank Math SEO is a widely used WordPress plugin that helps websites optimize their search engine visibility. The plugin contains a SQL injection vulnerability in a parameter that allows administrators to execute arbitrary database commands, potentially exposing or manipulating site data stored in the database.

Technologies: [Rank Math SEO](https://junglewise.ai/threats/technologies/rank-math-seo). Vendors: [Rank Math](https://junglewise.ai/threats/vendors/rank-math).

## Quick answers

**Is CVE-2026-104753 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104753 being exploited in the wild.

**How severe is CVE-2026-104753?** Medium severity, with a CVSS score of 4.1, published 10 October 2026.

**Which products and versions are affected?** Rank Math SEO before 1.0.280.

**Is there a fix for CVE-2026-104753?** Yes: fixed in 1.0.280. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104753 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104753?** Check whether you run Rank Math SEO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.0.280

## Technical details

The plugin fails to properly sanitize and escape the 'per_page' parameter before using it in a SQL query, allowing authenticated high-privilege users (administrators) to inject malicious SQL code. The vulnerability requires admin-level access and can be exploited to read, modify, or delete database records.

## Affected products

- Rank Math Rank Math SEO before 1.0.280

## Timeline

- 2026-10-08: disclosed

## References

- [https://wpscan.com/vulnerability/74d473c2-ced1-47f2-b530-dcd6ea003760/](https://wpscan.com/vulnerability/74d473c2-ced1-47f2-b530-dcd6ea003760/)

## Related threats

- [Rank Math SEO arbitrary file upload to RCE](https://junglewise.ai/threats/cve-2026-104752-the-rank-math-seo-wordpress-plugin-before-1-0-280-does-not)
- [Rank Math SEO privilege escalation in bulk metadata update](https://junglewise.ai/threats/cve-2026-77787-rank-math-seo-privilege-escalation-in-bulk-metadata-update)
- [Rank Math SEO privilege escalation via missing access control](https://junglewise.ai/threats/cve-2026-77784-rank-math-seo-privilege-escalation-via-missing-access-control)
- [Rank Math SEO information disclosure in password-protected content](https://junglewise.ai/threats/cve-2026-77782-rank-math-seo-information-disclosure-in-password-protected)
- [Rank Math SEO broken access control in WordPress plugin](https://junglewise.ai/threats/cve-2026-34892-rank-math-seo-broken-access-control-in-wordpress-plugin)