WordPress Plugin Vulnerabilities
Rank Math 0.9~1.0.42.1 - Authenticated Missing Access Controls to Disable Competitor Plugins
Description
Missing access controls on the GET requests to deactivate competitors' plugins. This could allow any authenticated users (such as subscribers) to deactivate the SEO and Sitemap plugins from competitors. The attack could also be performed via CSRF.
Proof of Concept
Affects Plugins
Fixed in 1.0.42.2 References
Miscellaneous
Original Researcher
Sybre Waaijer
Submitter
Sybre Waaijer
Submitter website
Submitter twitter
Verified
No
WPVDB ID
Timeline
Publicly Published
2020-04-18 (about 6 years ago)
Added
2020-06-16 (about 5 years ago)
Last Updated
2021-05-14 (about 4 years ago)
WPScan 