PT-2026-39972 · Phkcorp2005 · Wp-Redirection

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-7562

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due to the absence of a nonce field in the admin settings form and the lack of any nonce verification (via check admin referer() or wp verify nonce()) in the displayWPRedirectionManagementPage() function before processing POST requests that add, edit, or delete URL redirection rules. This makes it possible for unauthenticated attackers to trick a logged-in administrator into clicking a crafted link, causing the attacker to create, modify, or delete redirection records in the plugin's database table without the administrator's consent.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-7562

Affected Products

Wp-Redirection

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-7562 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-redirection/trunk/wp-redirection.php#L39 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/15177d1b-ef48-49e3-9bd9-34262ed2c134?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-redirection/tags/1.0.3/wp-redirection.php#L219 · Note
• https://plugins.trac.wordpress.org/browser/wp-redirection/trunk/wp-redirection.php#L219 · Note
• https://plugins.trac.wordpress.org/browser/wp-redirection/tags/1.0.3/wp-redirection.php#L39 · Note