Is CVE-2024-9161 actively exploited?

Yes. CVE-2024-9161 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2024-9161 be exploited remotely?

The attack vector of CVE-2024-9161 has not been classified yet.

What is the CVSS score of CVE-2024-9161?

CVE-2024-9161 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2024-9161

UNKNOWNCISA KEVIN THE WILD

CVE-2024-9161

Published: April 11, 2026

Official Description

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'update_metadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated attackers to insert new and update existing metadata beginning with 'rank_math', and delete arbitrary existing user metadata and term metadata. Deleting existing usermeta can cause a loss of access to the administrator dashboard for any registered users, including Administrators.

NVD Source

Technical Analysis

CVE-2024-9161 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2024-9161 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.