PT-2026-39972 · Phkcorp2005 · Wp-Redirection

CVE-2026-7562 · Publicado 2026-05-12 · Atualizado 2026-05-12

NVD

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due to the absence of a nonce field in the admin settings form and the lack of any nonce verification (via check admin referer() or wp verify nonce()) in the displayWPRedirectionManagementPage() function before processing POST requests that add, edit, or delete URL redirection rules. This makes it possible for unauthenticated attackers to trick a logged-in administrator into clicking a crafted link, causing the attacker to create, modify, or delete redirection records in the plugin's database table without the administrator's consent.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-7562

Produtos afetados

Wp-Redirection

Referências · 6

• https://plugins.trac.wordpress.org/browser/wp-redirection/trunk/wp-redirection.php#L39 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-7562 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/15177d1b-ef48-49e3-9bd9-34262ed2c134?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/wp-redirection/tags/1.0.3/wp-redirection.php#L219 · Nota
• https://plugins.trac.wordpress.org/browser/wp-redirection/trunk/wp-redirection.php#L219 · Nota
• https://plugins.trac.wordpress.org/browser/wp-redirection/tags/1.0.3/wp-redirection.php#L39 · Nota