CVE-2020-11514 is a critical vulnerability affecting the Rank Math plugin up to version 1.0.40.2 for WordPress. It allows unauthenticated remote attackers to update arbitrary WordPress metadata, including escalating or revoking administrative privileges for existing users through an unsecured REST API endpoint. With a CVSS score of 9.8 (CRITICAL) and an EPSS score indicating high exploitability, this flaw presents a severe risk. While not on the KEV catalog, exploit code is available via Nuclei templates, and the vulnerability has garnered significant community discussion, suggesting active interest in its exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.0.40.2CPE matchmatch criteria | cpe:2.3:a:rankmath:seo:*:*:*:*:free:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.