**Security vulnerability** in Schema Markup Rich Snippets plugin

#38660
  • Resolved DvT
    Rank Math free

    There is a security vulnerability in the free Schema Markup Rich Snippets plugin.
    It shows a script var rankMath = {"version":"1.0.1","ajaxurl":" ... and then shows the wp-admin url and a security code in the frontend of the website.
    We use this plugin just for creating the proper Google Jobs schema code on our job offer pages.

    I notice it has already been mentioned in the Support section here and here but in our website using the Schema Markup Rich Snippets plugin this bug still occurs. We got notified by an outsider.

Viewing 4 replies - 1 through 4 (of 4 total)
  • Hello,

    Thank you for contacting Rank Math and sorry for any inconvenience that might have been caused due to that.

    I have just raised this with our dev team and we will be getting back to you shortly with more info to address this vulnerability.

    Looking forward to helping you. Thank you.

    ​​​​​​​

    Hello,

    Thank you for letting us know about this issue. I have forwarded this issue to our Development Team and they will release an update soon with the fix.

    For now, to fix the issue on your site please change following code in plugins/schema-markup-rich-snippets/schema-markup-rich-snippets.php on line 381

    change:

    
    if ( is_user_logged_in() && is_admin_bar_showing() ) {
        $this->container['json']->add( 'version', $this->version, 'rankMath' );
        $this->container['json']->add( 'ajaxurl', admin_url( 'admin-ajax.php' ), 'rankMath' );
        $this->container['json']->add( 'adminurl', admin_url( 'admin.php' ), 'rankMath' );
       $this->container['json']->add( 'security', wp_create_nonce( 'rank-math-schema-ajax-nonce' ), 'rankMath' );
    		}
    

    to

    
    if ( is_user_logged_in() && is_admin_bar_showing() ) {
        $this->container['json']->add( 'version', $this->version, 'rankMath' );
        $this->container['json']->add( 'ajaxurl', admin_url( 'admin-ajax.php' ), 'rankMath' );
        $this->container['json']->add( 'adminurl', admin_url( 'admin.php' ), 'rankMath' );
        $this->container['json']->add( 'security', wp_create_nonce( 'rank-math-schema-ajax-nonce' ), 'rankMath' );
    }
    

    That should fix the issue.

    I hope that helps. If there is anything else, please let us know.

    Thank you.

    DvT
    Rank Math free

    I got a plugin fatal error when adding if ( is_user_logged_in() && is_admin_bar_showing() ) { however I now just removed the part starting line 381 completely, because we don’t need these frontend hints. We just need the JSON LD.

    Thanks!

    Hi there,

    Thanks for the follow up.

    I am glad that you were able to fix this 🙂

    Feel free to contact us should any other issues come up. Thank you.

Viewing 4 replies - 1 through 4 (of 4 total)

The ticket ‘**Security vulnerability** in Schema Markup Rich Snippets plugin’ is closed to new replies.