CVE-2020-11515: rankmath seo Open Redirect
Vulnerability summary
CVE-2020-11515 is a high (CVSS 7.4) Open Redirect vulnerability in rankmath seo. EPSS estimates a 2.07% chance of exploitation in the next 30 days, higher than 81.1% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.0.41.
Timeline
- 07-04-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
2.07%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
0.00 pp
From 2.07% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
- CWE-288Authentication Bypass Using an Alternate Path or ChannelThe product requires authentication, but the product has an alternate path or channel that does not require authentication.
Affected systems
Rankmath1 product
- seo≤ 1.0.40.2
Wordpress1 product
- seo-by-rank-math≤ 1.0.40 (fixed in 1.0.41)
2 vendors · 2 products