CVE-2024-9314 is a PHP Object Injection vulnerability classified under CWE-502 affecting the Rank Math SEO – AI SEO Tools to Dominate SEO Rankings WordPress plugin in versions up to 1.0.228. The vulnerability arises from unsafe deserialization of untrusted input in the 'set_redirections' function, allowing authenticated users with administrator privileges to inject PHP objects. Although the plugin does not contain a known POP chain to enable full exploitation, the presence of additional plugins or themes with gadget chains could enable attackers to perform destructive or unauthorized actions such as deleting files, retrieving sensitive information, or executing arbitrary code. The CVSS v3.1 base score is 7.2, indicating a high severity vulnerability with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

An attacker with administrator-level access can exploit this vulnerability to inject PHP objects via deserialization. Without a gadget chain in the plugin itself, direct exploitation is limited; however, if other installed plugins or themes provide a POP chain, the attacker could delete arbitrary files, access sensitive data, or execute arbitrary code, severely compromising the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the available data, administrators should monitor the vendor's communications for updates. In the meantime, restrict administrator access to trusted users only and consider disabling or removing the vulnerable plugin if possible until a fix is available.