Rank Math Plugin - Privilege Escalation (CVE-2020-11514)
Description
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
psychologyCrowdSec Analysis
CVE-2020-11514 is a critical vulnerability in the Rank Math WordPress plugin up to version 1.0.40.2, allowing unauthenticated remote attackers to update arbitrary WordPress metadata via an insecure REST API endpoint. This flaw can be exploited to escalate or revoke administrative privileges for existing users, potentially leading to full site compromise.
CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2020-11514 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the unprotected /wp-json/rankmath/v1/updateMeta REST API endpoint to escalate privileges or modify user metadata on vulnerable WordPress sites running the Rank Math SEO plugin.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2020-04-07 |
| Rule Released | 2025-09-24 |
| CrowdSec First Seen | 2025-09-25 |