CVE-2024-13229

Name of the Vulnerable Software and Affected Versions Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress versions up to, and including, 1.0.235

Description The issue is related to a missing capability check on the update metadata() function, which allows authenticated attackers with Contributor-level access and above to delete any schema metadata assigned to any post. This can lead to unauthorized loss of data.

Recommendations For versions up to, and including, 1.0.235, update to a version that includes a fix for the missing capability check on the update metadata() function. As a temporary workaround, consider restricting access to the update metadata() function to prevent unauthorized deletion of schema metadata. Restrict Contributor-level access and above to minimize the risk of exploitation.