Login Request a demo
Critical severity · published Apr 7, 2020
CVE-2020-11514
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke…
9.8
CVSS
10.9%
EPSS
No
On KEV
Description
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)10.9% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Seo · Rankmath
through 1.0.40.2 · source: NVD
Affected product
SE
Seo
Rankmath
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11514
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11514
Product
https://rankmath.com/changelog/
Product
https://wordpress.org/plugins/seo-by-rank-math/#developers
Exploit
https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
More from Seo
9.8
CVE-2022-36376
WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability
8.8
CVE-2023-23888
WordPress Rank Math SEO plugin <= 1.0.107.2 - Local File Inclusion vulnerability
7.2
CVE-2024-9314
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection
6.5
CVE-2024-9161
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete
6.5
CVE-2019-14786
The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter