Rank Math Plugin - Privilege Escalation (CVE-2020-11514)

CVE-2020-11514 is a critical vulnerability in the Rank Math WordPress plugin up to version 1.0.40.2, allowing unauthenticated remote attackers to update arbitrary WordPress metadata via an insecure REST API endpoint. This flaw can be exploited to escalate or revoke administrative privileges for existing users, potentially leading to full site compromise.

CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2025.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2020-11514 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2020-11514. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit the unprotected /wp-json/rankmath/v1/updateMeta REST API endpoint to escalate privileges or modify user metadata on vulnerable WordPress sites running the Rank Math SEO plugin.