Rank Math Plugin Vulnerable to PHP Object Injection Attacks

CVE-2024-9314

What is CVE-2024-9314?

The Rank Math SEO plugin for WordPress is susceptible to PHP Object Injection due to the insecure deserialization of untrusted input in the 'set_redirections' function. This vulnerability affects all versions up to and including 1.0.228. Authenticated attackers with Administrator-level access can exploit this flaw to inject a PHP Object. Although no known PHP Object Injection (POP) chain exists within the plugin itself, if an attacker has additional plugins or themes that provide a POP chain, they can potentially delete arbitrary files, access sensitive information, or execute malicious code on compromised systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References