{"metadata": {"vulnerability": "CVE-2026-1928", "count": 18, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-02-04T19:57:08.578Z", "date_only": false, "value": "2026-02-04T19:57:08.578Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-1928", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-02-04T20:24:58Z", "date_only": false, "value": "2026-02-04T20:24:58.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-1928", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-1928", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-28T03:42:54.378Z", "date_only": false, "value": "2026-10-28T03:42:54.378Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-1928", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T03:42:54.378Z", "date_only": false, "value": "2026-10-28T03:42:54.378Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-1928", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-28T03:53:39.236Z", "date_only": false, "value": "2026-10-28T03:53:39.236275Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117516508760594394", "record": "CVE-2026-1928", "field": "creation_timestamp", "uuid": "51482d34-f716-494c-8518-dd2be2101179", "content": "CVE-2026-1928 Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution The Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.\nhttps://www.cve.org/CVERecord?id=CVE-2026-1928https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4395be-7b4c-46b0-be00-7dedc6691f4a?source=cvehttps://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/rest/class-shared.php#L446https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/modules/schema/class-db.php#L66https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/rest/class-sanitize.php#L110https://plugins.trac.wordpress.org/changeset/3666725/#wordpress #rankmath #RankMathSEO\u2013AISEOToolstoDominateSEORankings#CVE_2026_1928#bot", "url": "https://infosec.exchange/users/cve/statuses/117516508760594394"}, {"timestamp": "2026-10-28T04:18:02Z", "date_only": false, "value": "2026-10-28T04:18:02Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F7V4-WPWR-74R2", "record": "GHSA-F7V4-WPWR-74R2", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-28T04:18:02.320Z", "date_only": false, "value": "2026-10-28T04:18:02.320", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-1928", "record": "FKIE_CVE-2026-1928", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T05:16:24.914Z", "date_only": false, "value": "2026-10-28T05:16:24.914957Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3myvyp2jvhq2w", "record": "CVE-2026-1928", "field": "creation_timestamp", "uuid": "3365e16a-6a68-43fc-a59b-af8715cde58d", "content": "\ud83d\udfe0 CVE-2026-1928 - High (8.8)\n\nThe Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-1928/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3myvyp2jvhq2w"}, {"timestamp": "2026-10-28T05:50:59.046Z", "date_only": false, "value": "2026-10-28T05:50:59.046259Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5x6zsnck5fdqm", "record": "CVE-2026-1928", "field": "creation_timestamp", "uuid": "75c88053-73c7-4ae7-b459-086be1cbda8c", "content": "CVE-2026-1928 - Rank Math SEO\nCVE ID : CVE-2026-1928\n \n Published : Oct. 28, 2026, 4:18 a.m. | 1\u00a0hour, 7\u00a0minutes ago\n \n Description : The Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/5x6zsnck5fdqm"}, {"timestamp": "2026-10-28T06:00:27.499Z", "date_only": false, "value": "2026-10-28T06:00:27.499371Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3myw35t2m7h2b", "record": "CVE-2026-1928", "field": "creation_timestamp", "uuid": "ab707c94-0f4d-4e3e-9085-be54adf5bb48", "content": "Rank Math SEO up to 1.0.276: PHP object injection lets Contributor-level users execute arbitrary code. CVE-2026-1928 (8.8/10). Update now. Scan your WordPress site: pulse-wp.com\n#WordPress #RCE #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3myw35t2m7h2b"}, {"timestamp": "2026-10-28T06:30:25Z", "date_only": false, "value": "2026-10-28T06:30:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F7V4-WPWR-74R2", "record": "GHSA-F7V4-WPWR-74R2", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T06:30:25Z", "date_only": false, "value": "2026-10-28T06:30:25Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F7V4-WPWR-74R2", "record": "GHSA-F7V4-WPWR-74R2", "field": "modified"}, {"timestamp": "2026-10-29T01:31:53.118Z", "date_only": false, "value": "2026-10-29T01:31:53.118645Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-1928", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-29T01:31:53.118Z", "date_only": false, "value": "2026-10-29T01:31:53.118645Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-1928", "record": "FKIE_CVE-2026-1928", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-29T01:41:55.325Z", "date_only": false, "value": "2026-10-29T01:41:55.325Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-1928", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-29T01:41:55.325Z", "date_only": false, "value": "2026-10-29T01:41:55.325Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-1928", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-29T02:16:51.953Z", "date_only": false, "value": "2026-10-29T02:16:51.953", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-1928", "record": "FKIE_CVE-2026-1928", "field": "lastModified"}], "metrics": {"as_of": "2026-11-02T07:17:44.202Z", "anchors": {"origin": {"timestamp": "2026-10-28T03:42:54.378Z", "date_only": false, "value": "2026-10-28T03:42:54.378Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-1928", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T03:42:54.378Z", "date_only": false, "value": "2026-10-28T03:42:54.378Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-1928", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 444889.824865, "hours": 123.58050690694444, "days": 5.1491877877893515, "min_seconds": 444889.824865, "max_seconds": 444889.824865, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T03:42:54.378Z", "date_only": false, "value": "2026-10-28T03:42:54.378Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-1928", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-02T07:17:44.202Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}