CVE-2020-11514
critical · 9.8A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
9.8
CVSS
10.9%
EPSS (exploit prob.)
96th
EPSS percentile
2020-04-07
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-862
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| rankmath | seo | <= 1.0.40.2 |
Check a specific version with /api/v1/cve/match.
References
- https://rankmath.com/changelog/
- https://wordpress.org/plugins/seo-by-rank-math/#developers
- https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
- https://rankmath.com/changelog/
- https://wordpress.org/plugins/seo-by-rank-math/#developers
- https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2020-11514