CVE-2020-11514

EPSS 9.1%◆ VulnCheck KEV

Vexday Risk Score

40Attention

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 9.1%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

07 Apr 2020Published on NVD

Recommendation: Patch as soon as possible — active exploitation confirmed.

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.

Affected products

n/a · n/a

References

https://rankmath.com/changelog/https://wordpress.org/plugins/seo-by-rank-math/#developers https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/