Executive brief
The WP-Redirection plugin for WordPress, which manages website URL redirects, is vulnerable to a security flaw that allows attackers to change site settings. By tricking a logged-in administrator into clicking a malicious link, an attacker can add, modify, or delete redirection rules. This could be used to redirect legitimate site visitors to malicious websites or disrupt the site's navigation.
Technical details
The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to a lack of nonce validation in the displayWPRedirectionManagementPage() function. Specifically, the plugin fails to implement check_admin_referer() or wp_verify_nonce() before processing POST requests for adding, editing, or deleting URL redirection rules. An unauthenticated attacker can exploit this by crafting a malicious link or page and inducing a logged-in administrator to interact with it. Successful exploitation allows the attacker to manipulate the plugin's database records, potentially leading to unauthorized URL redirects. The vulnerability exists in all versions up to and including 1.0.3.
Affected products
- WP-Redirection WP-Redirection Up to and including 1.0.3
Timeline
- 2026-05-12: disclosed: CVE published by Wordfence and NVD
References
- https://plugins.trac.wordpress.org/browser/wp-redirection/tags/1.0.3/wp-redirection.php
- https://plugins.trac.wordpress.org/browser/wp-redirection/tags/1.0.3/wp-redirection.php
- https://plugins.trac.wordpress.org/browser/wp-redirection/trunk/wp-redirection.php
- https://plugins.trac.wordpress.org/browser/wp-redirection/trunk/wp-redirection.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/15177d1b-ef48-49e3-9bd9-34262ed2c134?source=cve