# CVE-2020-11514: Rank Math Plugin - Privilege Escalation

> Live exploitation tracking for CVE-2020-11514 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2020-11514

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Rank Math SEO
- **Weaknesses:** CWE-862 (Missing Authorization)
- **Tags:** wordpress

## Description

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.

## CrowdSec analysis

[CVE-2020-11514](https://euvd.enisa.europa.eu/vulnerability/CVE-2020-11514) is a critical vulnerability in the Rank Math WordPress plugin up to version 1.0.40.2, allowing unauthenticated remote attackers to update arbitrary WordPress metadata via an insecure REST API endpoint. This flaw can be exploited to escalate or revoke administrative privileges for existing users, potentially leading to full site compromise.

CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2020-11514 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the unprotected `/wp-json/rankmath/v1/updateMeta` REST API endpoint to escalate privileges or modify user metadata on vulnerable WordPress sites running the Rank Math SEO plugin.

## Timeline

- 2020-04-07: CVE Published. CVE-2020-11514 is published to NVD.
- 2025-09-24: Rule Released. CrowdSec releases a rule to detect CVE-2020-11514 exploitation attempts against the CrowdSec Network.
- 2025-09-25: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2020-11514 for the first time.

## References

- https://rankmath.com/changelog/
- https://wordpress.org/plugins/seo-by-rank-math/#developers
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11514.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2020-11514) follows observed exploitation activity for CVE-2020-11514. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.