Description
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint http/cves/2020/CVE-2020-11515.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.