CVE-2024-9161
Published: 05 October 2024
Summary
CVE-2024-9161 is a medium-severity Missing Authorization (CWE-862) vulnerability in Rankmath Seo. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Rank Math SEO plugin for WordPress is affected by CVE-2024-9161, a missing capability check in the update_metadata function present in all versions through 1.0.228. The flaw resides in the plugin's REST API handling code and permits unauthenticated callers to perform metadata operations without any authorization check, directly violating CWE-862.
Unauthenticated attackers can therefore insert or overwrite any metadata keys beginning with the rank_math prefix and delete arbitrary user or term metadata entries. Successful exploitation can remove administrative capabilities from registered accounts, including site administrators, resulting in loss of dashboard access while leaving the site otherwise functional. The vulnerability is remotely exploitable with low attack complexity and no required user interaction, corresponding to the published CVSS 6.5 score.
Public references include the vulnerable code paths in class-shared.php and the corrective changeset 3161896, indicating that an update addressing the missing authorization check has been published in the plugin repository.
EPSS for the CVE rose from lower values to a peak of 0.2875 before receding to the current 0.2364, demonstrating measurable post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49763
Vulnerability details
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'update_metadata' function in all versions up to, and…
more
including, 1.0.228. This makes it possible for unauthenticated attackers to insert new and update existing metadata beginning with 'rank_math', and delete arbitrary existing user metadata and term metadata. Deleting existing usermeta can cause a loss of access to the administrator dashboard for any registered users, including Administrators.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated exploitation of public-facing WordPress plugin (T1190) enables stored data manipulation via metadata updates (T1565), data destruction via metadata deletion (T1485), and account access removal by deleting user metadata to lock out administrators (T1531).
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.