Seo By Rank Math <= 1.0.27 - Authenticated Settings Reset



Description
Allows any authenticated user (with a role as low as subscriber) to reset Settings of the plugin.
Proof of Concept
https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.27/includes/admin/class-options.php#L91

https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.27/includes/admin/class-options.php#L200

Affects Plugin

fixed in version 1.0.27.1

References

CVE 2019-14786
URL https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.27.1/includes/admin/class-options.php#L202

Classification

Type BYPASS

Miscellaneous

Views 3276
Verified No
WPVDB ID 9375

Timeline

Publicly Published 2019-06-21 (4 months ago)
Added 2019-06-21 (4 months ago)
Last Updated 2019-08-21 (2 months ago)

Our Other Services

Online WordPress Vulnerability Scanner WPScan WordPress Security Plugin