CVE-2024-9161mediumexploração observadaCWE-862

CVE-2024-9161: falha de média gravidade em rankmath Rank Math SEO – AI SEO Tools to…

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

50Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 6.5epss 2.1%
da publicação à arma
Publicada no NVD5 de out.
VulnCheck+20d
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'update_metadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated attackers to insert new and update existing metadata beginning with 'rank_math', and delete arbitrary existing user metadata and term metadata. Deleting existing usermeta can cause a loss of access to the administrator dashboard for any registered users, including Administrators.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
rankmath · Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
CVEs relacionadas — rankmath Rank Math SEO – AI SEO Tools to…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-9314HIGHRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object InjectionEPSS 0.8%CVE-2026-1928HIGHRank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code ExecutionEPSS 0.5%CVE-2024-13227MEDIUMRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math APIEPSS 0.5%CVE-2024-3665MEDIUMRank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'EPSS 0.5%CVE-2024-13229MEDIUMRank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema DeletionEPSS 0.5%CVE-2024-4335MEDIUMRank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%