Rank Math Plugin Vulnerable to PHP Object Injection Attacks

CVE-2024-9314

Summary

The Rank Math SEO plugin for WordPress is susceptible to PHP Object Injection due to the insecure deserialization of untrusted input in the 'set_redirections' function. This vulnerability affects all versions up to and including 1.0.228. Authenticated attackers with Administrator-level access can exploit this flaw to inject a PHP Object. Although no known PHP Object Injection (POP) chain exists within the plugin itself, if an attacker has additional plugins or themes that provide a POP chain, they can potentially delete arbitrary files, access sensitive information, or execute malicious code on compromised systems.

References