CVE-2019-14786 Missing authorization in n/a
Non-admin users can reset Rank Math SEO plugin settings due to missing authorization checks, potentially disrupting site configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-14786?
CVE-2019-14786 is a medium-severity missing authorization vulnerability in n/a, published on 15 Aug 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.
Weakness: CWE-862
Which versions are affected by CVE-2019-14786?
It affects 1 product.
Products include Rankmath Seo.
How do I fix CVE-2019-14786?
No fix has been published for CVE-2019-14786 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-14786 being exploited?
There is no known exploitation of CVE-2019-14786 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-11514 Missing authorization in n/a
- CVE-2023-23888 WordPress Rank Math SEO plugin <= 1.0.107.2 - Local File Inclusion vulnerability
- CVE-2024-9314 Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection
- CVE-2022-36376 WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability
- CVE-2024-9161 Missing authorization in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Sources
Also known as GHSA-cm2r-2mx3-6fv2.