PT-2024-39463 · WordPress · Rank Math Seo

Leo + 1 · Published 2024-10-05 · Updated 2025-12-01 · CVE-2024-9161

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress versions up to, and including, 1.0.228

Description The issue is caused by a missing capability check on the update metadata function, allowing unauthenticated attackers to insert new and update existing metadata beginning with rank math, and delete arbitrary existing user metadata and term metadata. This can lead to a loss of access to the administrator dashboard for any registered users, including Administrators.

Recommendations For versions up to, and including, 1.0.228, update to a version higher than 1.0.228 to resolve the issue. As a temporary workaround, consider disabling the update metadata function until a patch is available. Restrict access to metadata beginning with rank math to minimize the risk of exploitation. Avoid using the update metadata function in the affected plugin until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-9161

Affected Products

Rank Math Seo

References · 15

• https://osv.dev/vulnerability/CVE-2024-9161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9161 · Security Note
• https://plugins.trac.wordpress.org/changeset/3161896 · Patch
• https://twitter.com/VulmonFeeds/status/1842599524692377972 · Twitter Post
• https://t.me/cvedetector/7054 · Telegram Post
• https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php#L161 · Note
• https://t.me/cvenotify/97133 · Telegram Post
• https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php#L162 · Note
• https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php#L120 · Note
• https://t.me/cvenotify/109052 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1995553513527705711 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7df39a64-76c5-4ebe-a271-44bd147a3a86?source=cve · Note
• https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php#L64 · Note
• https://twitter.com/CVEnew/status/1842529708250194037 · Twitter Post
• https://twitter.com/aicyberinsights/status/1843717766580421003 · Twitter Post