WordPress Plugin Vulnerabilities

Rank Math SEO < 1.0.236 - Contributor+ Arbitrary Schema Deletion

Description

The plugin is vulnerable to unauthorized loss of data due to a missing capability check on the update_metadata() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete any schema metadata assigned to any post.

Affects Plugins

Plugin icon
seo-by-rank-math
Fixed in 1.0.236

References

CVE
CVE-2024-13229
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5776f689-56dd-413d-b02d-5551b97dd5eb

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Webbernaut
Verified
No
WPVDB ID
98c182aa-1806-4d50-9a0e-08aad6c9fcf2

Timeline

Publicly Published
2025-02-12 (about 1 year ago)
Added
2025-02-12 (about 1 year ago)
Last Updated
2025-02-12 (about 1 year ago)

Other

Published
Title
Published
2022-01-04
Title
Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion
Published
2021-10-11
Title
Post Expirator < 2.6.0 - Contributor+ Arbitrary Post Schedule Deletion
Published
2024-01-10
Title
WP Customer Area < 8.2.1 - Subscriber+ Account Address Update
Published
2021-01-22
Title
Doneren met Mollie < 2.8.5 - Unauthorised CSV Export leading to Sensitive Data Disclosure
Published
2026-08-20
Title
Conekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery