PT-2023-11841 · WordPress · Quick Page/Post Redirect Plugin

Jerome Bruandet · Published 2023-06-07 · Updated 2023-06-12 · CVE-2020-36699

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Quick Page/Post Redirect Plugin for WordPress versions up to, and including, 5.1.9

Description The issue is related to authorization bypass due to missing capability checks on the qppr save quick redirect ajax and qppr delete quick redirect functions. This allows low-privileged attackers to interact with the plugin settings and create a redirect link that would forward all traffic to an external malicious website.

Recommendations For versions up to, and including, 5.1.9, update to a version that includes the necessary capability checks to prevent authorization bypass.

Exploit

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2020-36699

Affected Products

Quick Page/Post Redirect Plugin

References · 6

• 🔥 https://blog.nintechnet.com/authenticated-settings-change-vulnerability-in-wordpress-quick-page-post-redirect-plugin-unpatched · Exploit
• https://osv.dev/vulnerability/CVE-2020-36699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36699 · Security Note
• https://acunetix.com/vulnerabilities/web/wordpress-plugin-quick-page-post-redirect-security-bypass-5-1-9 · Note
• https://wpscan.com/vulnerability/10198 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/11c4b855-8589-4ad2-b414-566ac8eb4632?source=cve · Note