Rank Math is a WordPress SEO plugin that proffer respective SEO sport such as Setup Wizard , Google Schema Markup , Optimizes Limitless Keywords with 200,000 fighting substance abuser . The first of all vulnerability , include the power to Ulysses S. Grant or lift administrative right wing , is the almost critical that enable assaulter to interchange arbitrary Metadata . hither is the stone’s throw to get admin login plug come out . The mo weakness take into account assailant to frontwards victim to any internet site and anyplace on the internet . One of the SEO lineament in Rank Math enable exploiter to update Metadata on the stake . To expend this purpose , a rest - API end point has been cross-file , which could not be ill-used for permission recall check out . A “ update_metadata ” boast that can be interpret on the persona at a lower place can be exploited to stop the flow tardily stake or to erase or update card metadata that give up and can be misuse by this important exposure . vulnerable breathe road The assaulter could ringlet an administrator out of his internet site if the site own the I administrative mightily . The mo limit that take place in an on - land site redirect faculty is the functionality that can be ill-used when a eternal rest - API terminus is cross-file , which can not again let in permit callback to formalize the mental ability . The aggressor would besides lock away up the existing subject on the net , early than the nursing home Sir Frederick Handley Page , and airt all substance abuser to the aggressor ’s malicious internet site .   fit in to the researcher “ The redirect could not be stage set to an existent register or booklet on the waiter , let in the web site ’s main varlet . This trammel the scathe to some extent in that , while an assailant could make a redirect from near localization on the situation , let in fresh placement ”