What’s Vulnerable › Vulnerabilities

CVE-2020-11515

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-04-07 · updated 2026-06-17
• Weakness: CWE-601

Description

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).

Affected products

• Rank Math SEO: through 1.0.40.2

References

• https://rankmath.com/changelog/
• https://wordpress.org/plugins/seo-by-rank-math/#developers
• https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
• https://rankmath.com/changelog/
• https://wordpress.org/plugins/seo-by-rank-math/#developers
• https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/

Get alerted when CVE-2020-11515 or the next vulnerability affects your stack