CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-11514
Critical (9.8) in rankmath seo. EPSS 11% chance of exploitation in the next 30 days.
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
Severity
- EPSS
- 11% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rankmath:seo
References
- https://rankmath.com/changelog/
- https://wordpress.org/plugins/seo-by-rank-math/#developers
- https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
- https://rankmath.com/changelog/
- https://wordpress.org/plugins/seo-by-rank-math/#developers