CVE-2020-11514

EPSS 9.1%◆ VulnCheck KEV

Vexday Risk Score

40Atención

Decisión SSVC (CISA)

Act

Explotación + impacto → acción inmediata

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 9.1%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

07 abr 2020Publicada en NVD

Recomendación: Corregir cuanto antes — hay explotación activa confirmada.

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.

Productos afectados

n/a · n/a

Referencias

https://rankmath.com/changelog/https://wordpress.org/plugins/seo-by-rank-math/#developers https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/