CVE-2024-9161: Rank Math SEO Auth Bypass Vulnerability

CVE-2024-9161 Overview

The Rank Math SEO – AI SEO Tools plugin for WordPress contains a missing authorization flaw in its update_metadata REST endpoint. The issue affects all versions up to and including 1.0.228. Unauthenticated attackers can insert or update metadata prefixed with rank_math and delete arbitrary user metadata and term metadata. Deleting user metadata can lock registered users, including Administrators, out of the WordPress dashboard. The vulnerability is tracked under CWE-862: Missing Authorization and was published to the National Vulnerability Database (NVD) on October 5, 2024.

Critical Impact
Unauthenticated attackers can delete arbitrary user metadata, potentially removing administrator access to the WordPress dashboard on any site running a vulnerable Rank Math SEO installation.

Affected Products

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (WordPress plugin) versions ≤ 1.0.228
Free edition distributed via the WordPress plugin repository
All WordPress sites with the plugin installed and network-reachable

Discovery Timeline

2024-10-05 - CVE-2024-9161 published to the NVD
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-9161

Vulnerability Analysis

The vulnerability resides in the plugin's shared REST controller at includes/rest/class-shared.php. The update_metadata function processes metadata write and delete operations without verifying the caller's capabilities. Because the REST route lacks a proper permission_callback, any unauthenticated HTTP client can invoke it directly.

The function allows two harmful operations. First, attackers can create or overwrite metadata whose keys begin with the rank_math prefix on posts, users, or terms. Second, attackers can delete arbitrary existing user metadata and term metadata regardless of key prefix. Deleting entries such as wp_capabilities or wp_user_level strips role assignments from WordPress users, breaking dashboard access for Administrators and other privileged accounts.

Root Cause

The root cause is a missing capability check on a REST API endpoint. The handler executes privileged database operations against WordPress metadata tables (wp_usermeta, wp_termmeta, wp_postmeta) without calling current_user_can() or enforcing a nonce. This is a textbook CWE-862 broken access control condition.

Attack Vector

Exploitation requires only network access to the WordPress REST API. An attacker sends a crafted HTTP request to the vulnerable Rank Math REST route, specifying the object type, object ID, meta key, and desired operation. No authentication, user interaction, or elevated privileges are needed. See the Wordfence Vulnerability Report and the vulnerable code at class-shared.php line 120 for reference.

No verified public exploit code is available. The vulnerability mechanism is described in prose to avoid publishing weaponized proof-of-concept payloads.

Detection Methods for CVE-2024-9161

Indicators of Compromise

Unauthenticated POST or DELETE requests to Rank Math REST routes under /wp-json/rankmath/v1/ that reference metadata operations
Sudden loss of administrator dashboard access for one or more WordPress users
Unexpected new rows in wp_postmeta, wp_usermeta, or wp_termmeta with keys prefixed by rank_math
Missing wp_capabilities or wp_user_level entries in wp_usermeta for previously privileged accounts

Detection Strategies

Review web server and WordPress access logs for requests to Rank Math REST endpoints originating from unauthenticated sessions
Alert on HTTP requests to /wp-json/rankmath/ that include metadata parameters such as objectType, objectID, or meta
Compare current wp_usermeta contents against a known-good backup to identify deletions of role or capability entries

Monitoring Recommendations

Forward WordPress and reverse-proxy logs to a central SIEM or data lake for anomaly analysis
Track REST API request rates per source IP against Rank Math endpoints and threshold on spikes
Monitor administrator login failures and sudden role changes as secondary indicators of exploitation

How to Mitigate CVE-2024-9161

Immediate Actions Required

Update the Rank Math SEO plugin to a version later than 1.0.228 on every WordPress site in the environment
Audit wp_usermeta for missing wp_capabilities or wp_user_level entries and restore them from backup where needed
Rotate credentials for any administrator whose metadata was tampered with
Review REST API access logs for prior exploitation attempts predating the patch

Patch Information

The vendor addressed the missing capability check in WordPress Plugin Changeset #3161896. The fix introduces proper permission callbacks on the affected REST routes so that unauthenticated callers can no longer invoke update_metadata. Administrators should apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Temporarily deactivate the Rank Math SEO plugin until patching is complete
Block external access to /wp-json/rankmath/ routes at the web application firewall (WAF) or reverse proxy
Restrict WordPress REST API access to authenticated users where site functionality allows

bash

# Update Rank Math SEO plugin via WP-CLI to a patched version
wp plugin update seo-by-rank-math

# Verify installed version is greater than 1.0.228
wp plugin get seo-by-rank-math --field=version

# Optional: block unauthenticated access to Rank Math REST routes at nginx
# location ~* /wp-json/rankmath/ {
#     if ($http_authorization = "") { return 401; }
# }