CVE-2022-36376 WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability
Attackers can exploit SSRF in Rank Math SEO to access internal resources or bypass security controls on WordPress sites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-36376?
CVE-2022-36376 is a medium-severity server-side request forgery vulnerability in Rank Math SEO (WordPress plugin), published on 9 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress.
Weakness: CWE-918
Which versions are affected by CVE-2022-36376?
2 open source packages ship an affected version, including rankmath/seo-by-rank-math. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rankmath/seo-by-rank-math Packagist | All versions to 1.0.95 | None |
rankmath/seo-by-rank-math Packagist | All versions to 1.0.95 | None |
Products include Rankmath Seo.
How do I fix CVE-2022-36376?
No fix has been published for CVE-2022-36376 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-36376 being exploited?
There is no known exploitation of CVE-2022-36376 in the wild and no public exploit code.
Other vulnerabilities in Rank Math SEO (WordPress plugin)
- CVE-2020-11514 Missing authorization in n/a
- CVE-2023-23888 WordPress Rank Math SEO plugin <= 1.0.107.2 - Local File Inclusion vulnerability
- CVE-2024-9314 Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection
- CVE-2024-9161 Missing authorization in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
- CVE-2023-32600 WordPress Rank Math SEO Plugin <= 1.0.119 is vulnerable to Cross Site Scripting (XSS)
Sources
Also known as GHSA-j95r-86hx-xwxg.