CVE-2024-9161mediumexplotación observadaCWE-862

CVE-2024-9161: fallo de gravedad media en rankmath Rank Math SEO – AI SEO Tools to…

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

50Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 6.5epss 2.1%
de la publicación al arma
Publicada en NVD5 oct
VulnCheck+20d
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'update_metadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated attackers to insert new and update existing metadata beginning with 'rank_math', and delete arbitrary existing user metadata and term metadata. Deleting existing usermeta can cause a loss of access to the administrator dashboard for any registered users, including Administrators.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Productos afectados
rankmath · Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
CVEs relacionadas — rankmath Rank Math SEO – AI SEO Tools to…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-9314HIGHRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object InjectionEPSS 0.8%CVE-2026-1928HIGHRank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code ExecutionEPSS 0.5%CVE-2024-13227MEDIUMRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math APIEPSS 0.5%CVE-2024-3665MEDIUMRank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'EPSS 0.5%CVE-2024-13229MEDIUMRank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema DeletionEPSS 0.5%CVE-2024-4335MEDIUMRank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%