CVE-2020-11515
40Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 2.1%
from disclosure to weapon
Published on NVDApr 7
VulnCheck+1028d
exploitation probability
2.1%top 20% of all CVEs
observed exploitation
yesVulnCheck
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).
Affected products
n/a · n/a