{"id":"CVE-2022-36376","aliases":["EUVD-2022-6851","GHSA-j95r-86hx-xwxg"],"status":"published","title":"WordPress Rank Math SEO plugin \u003c= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability","description":"Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin \u003c= 1.0.95 at WordPress.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01011,"percentile":0.63416,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2022-09-09T14:39:53Z","modified":"2026-06-17T04:53:21Z","affected":[{"source":"ghsa","ecosystem":"Packagist","package":"rankmath/seo-by-rank-math","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.95"}]}]},{"source":"osv","ecosystem":"Packagist","package":"rankmath/seo-by-rank-math","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.95"}]}],"versions":["v1.0.44","v1.0.45","v1.0.46","v1.0.47","v1.0.47.1","v1.0.47.1-beta","v1.0.48","v1.0.48-beta","v1.0.48-beta-2","v1.0.48.1","v1.0.48.2","v1.0.48.2-beta","v1.0.49","v1.0.49-beta","v1.0.49.1-beta","v1.0.50","v1.0.50.1","v1.0.51","v1.0.52","v1.0.52.1","v1.0.52.2","v1.0.52.3","v1.0.53","v1.0.53.1","v1.0.54","v1.0.54.1","v1.0.54.2","v1.0.54.3","v1.0.55","v1.0.56","v1.0.56-beta","v1.0.56.1","v1.0.57","v1.0.57.1","v1.0.58","v1.0.59","v1.0.59.1","v1.0.60","v1.0.60.1","v1.0.61","v1.0.61.1","v1.0.62","v1.0.63","v1.0.64","v1.0.65","v1.0.66","v1.0.66.1","v1.0.67","v1.0.68","v1.0.68.1","v1.0.69","v1.0.69.1","v1.0.69.2","v1.0.70","v1.0.94","v1.0.95"]}],"products":[{"vendor":"rank math","product":"rank math seo (wordpress plugin)"},{"vendor":"rankmath","product":"seo"}],"references":[{"url":"https://patchstack.com/database/vulnerability/seo-by-rank-math/wordpress-rank-math-seo-plugin-1-0-95-server-side-request-forgery-ssrf-vulnerability/_s_id=cve","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Third Party Advisory"]},{"url":"https://rankmath.com/changelog/","tags":["x_refsource_CONFIRM","x_transferred","Product","Release Notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36376","tags":["advisory"]},{"url":"https://patchstack.com/database/vulnerability/seo-by-rank-math/wordpress-rank-math-seo-plugin-1-0-95-server-side-request-forgery-ssrf-vulnerability","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j95r-86hx-xwxg"},{"url":"https://github.com/rankmath/seo-by-rank-math","tags":["package"]},{"url":"https://rankmath.com/changelog","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-36376","title":"WordPress Rank Math SEO plugin \u003c= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability","description":"Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin \u003c= 1.0.95 at WordPress.","status":"published","published":"2022-09-09T14:39:53.112Z","modified":"2026-04-28T16:07:45.462Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:35.945659Z"}],"euvd":[{"id":"EUVD-2022-6851","description":"Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin \u003c= 1.0.95 at WordPress.","status":"published","published":"2022-09-09T14:39:53Z","modified":"2026-04-28T16:07:45Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:15.342076Z"}],"ghsa":[{"id":"GHSA-j95r-86hx-xwxg","title":"Rank Math SEO plugin vulnerable to Server-Side Request Forgery","description":"Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin \u003c= 1.0.95 at WordPress.","status":"published","published":"2022-09-10T00:00:27Z","modified":"2023-01-27T05:02:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:36:18.427692Z"}],"nvd":[{"id":"CVE-2022-36376","description":"Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin \u003c= 1.0.95 at WordPress.","status":"published","published":"2022-09-09T15:15:10.627Z","modified":"2026-06-17T04:53:21.097Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:07:27.631109Z"}],"osv":[{"id":"GHSA-j95r-86hx-xwxg","title":"Rank Math SEO plugin vulnerable to Server-Side Request Forgery","description":"Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin \u003c= 1.0.95 at WordPress.","status":"published","published":"2022-09-10T00:00:27Z","modified":"2024-02-21T05:51:31.206273Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:50.336262Z"}]}}