PT-2020-12659 · Mythemeshop · Rank Math

Published 2020-04-07 · Updated 2025-09-18 · CVE-2020-11515

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rank Math plugin versions 1.0.40.2 and earlier

Description The issue allows unauthenticated remote attackers to create new URIs that redirect to an external web site via the unsecured "rankmath/v1/updateRedirection" REST API endpoint. This enables attackers to create a new URI with an arbitrary name.

Recommendations For Rank Math plugin versions 1.0.40.2 and earlier, consider disabling access to the "rankmath/v1/updateRedirection" REST API endpoint until a patch is available. Restrict the ability to create new URIs to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-11515

Affected Products

Rank Math

References · 8

• 🔥 https://wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2020-11515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11515 · Security Note
• https://wordpress.org/plugins/seo-by-rank-math/#developers · Note
• https://twitter.com/pdnuclei_bot/status/1968570737171517729 · Twitter Post
• https://t.me/cvenotify/50978 · Telegram Post
• https://rankmath.com/changelog · Note
• https://t.me/cvenotify/51188 · Telegram Post