The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings WordPress plugin suffers from a missing authorization check vulnerability identified as CVE-2024-9161 (CWE-862). This flaw exists in the 'update_metadata' function across all versions up to and including 1.0.228. Due to the absence of capability verification, unauthenticated attackers can remotely invoke this function to insert new metadata or update existing metadata entries that begin with the prefix 'rank_math'. Furthermore, attackers can delete arbitrary user metadata and term metadata. Deletion of user metadata can lead to loss of access to the WordPress administrator dashboard for any registered user, including administrators, effectively locking out legitimate site owners. The vulnerability does not require any privileges or user interaction and can be exploited over the network, making it accessible to any remote attacker. The CVSS 3.1 base score is 6.5 (medium), reflecting the ease of exploitation and the impact on integrity and availability, though confidentiality is not affected. No patches or exploit code are currently publicly available, but the risk remains significant due to the potential for site disruption and administrative lockout.

This vulnerability can have severe consequences for organizations relying on the Rank Math SEO plugin. Unauthorized modification of SEO-related metadata can degrade website search engine rankings, manipulate site content, or inject malicious data affecting site behavior. More critically, deletion of user metadata can lock out administrators and other users from the WordPress dashboard, disrupting site management and potentially causing prolonged downtime. This can impact business operations, especially for organizations that depend heavily on their web presence for marketing, sales, or customer engagement. The ease of exploitation without authentication increases the risk of automated attacks and widespread exploitation. Although no known exploits are currently reported, the vulnerability represents a significant risk to website integrity and availability, potentially leading to reputational damage and financial loss.

To mitigate this vulnerability, organizations should immediately update the Rank Math SEO plugin to a patched version once available. Until a patch is released, administrators should consider temporarily disabling the plugin to prevent exploitation. Implementing a Web Application Firewall (WAF) with rules to detect and block unauthorized requests targeting metadata update endpoints can reduce risk. Restricting access to the WordPress admin and AJAX endpoints via IP whitelisting or VPN access can also limit exposure. Regular backups of the WordPress database and user metadata are essential to enable recovery in case of data deletion. Monitoring logs for suspicious requests related to metadata updates and unusual user metadata deletions can help detect exploitation attempts early. Finally, applying the principle of least privilege to WordPress user roles and auditing installed plugins for security compliance can reduce overall attack surface.