// For flags

CVE-2024-11620

WordPress Rank Math SEO plugin <= 1.0.231 - Arbitrary .htaccess Overwrite to Remote Code Execution (RCE) vulnerability

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Improper Control of Generation of Code ('Code Injection') vulnerability in Rank Math SEO allows Code Injection.This issue affects Rank Math SEO: from n/a through 1.0.231.

La vulnerabilidad de control inadecuado de generación de código ('Inyección de código') en Rank Math SEO permite la inyección de código. Este problema afecta a Rank Math SEO: desde n/a hasta 1.0.231.

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.231. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.

*Credits: Rafie Muhammad (Patchstack)
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2024-11-22 CVE Reserved
  • 2024-11-22 CVE Published
  • 2024-11-28 CVE Updated
  • 2024-11-29 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
  • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
CAPEC
  • CAPEC-242: Code Injection
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Seo By Rank Math
Search vendor "Seo By Rank Math"
 Seo By Rank Math
Search vendor "Seo By Rank Math" for product "Seo By Rank Math"
 >= 0.0.0 <= 1.0.231
Search vendor "Seo By Rank Math" for product "Seo By Rank Math" and version " >= 0.0.0 <= 1.0.231"
en
Affected