Description

WordPress Plugin Rank Math SEO-Best SEO For WordPress To Increase Your SEO Traffic is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently update arbitrary metadata, which includes the ability to grant or revoke administrative privileges for any registered user on the site. WordPress Plugin Rank Math SEO-Best SEO For WordPress To Increase Your SEO Traffic version 1.0.40.2 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.0.41 or latest

References

https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/

https://rankmath.com/changelog/

Related Vulnerabilities

Contao Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2015-0269)

WordPress Plugin Slimstat Analytics Cross-Site Scripting (0.9.2)

Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-5651)

Oracle JRE CVE-2013-2434 Vulnerability (CVE-2013-2434)

WordPress Plugin Timeline Calendar SQL Injection (1.2)

Severity

High

Classification

CVE-2020-11514 CVE-2020-11515 CWE-264 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass