CVE-2024-9161: Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'updatemetadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated attackers to insert new and update existing metadata beginning with 'rankmath', and delete arbitrary existing user metadata and term metadata. Deleting existing usermeta can cause a loss of access to the administrator dashboard for any registered users, including Administrators.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9161?
CVE-2024-9161 has a moderate severity level due to its potential for unauthorized modification and data loss.
How do I fix CVE-2024-9161?
To fix CVE-2024-9161, update the Rank Math SEO plugin to version 1.0.229 or later.
What versions are affected by CVE-2024-9161?
CVE-2024-9161 affects all versions of the Rank Math SEO plugin up to and including version 1.0.228.
What kind of data is at risk due to CVE-2024-9161?
CVE-2024-9161 puts the site's metadata at risk due to the vulnerability in the 'update_metadata' function.
Is there a known exploit for CVE-2024-9161?
As of now, there are no public reports of active exploits targeting CVE-2024-9161.