Redirect Redirection <= 1.1.3 - Missing Authorization in 'addRedirect' function

Wordfence Intelligence   >   Vulnerability Database   >   Redirect Redirection <= 1.1.3 - Missing Authorization in 'addRedirect' function
4.3
Missing Authorization
CVSS 4.3 (Medium)
Publicly Published February 21, 2023
Last Updated January 22, 2024

Description

The Redirect Redirection plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the addRedirect function called via an AJAX action in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with subscriber-level access, and above, to add redirects to a vulnerable site.

Wordfence blocked 25 attacks targeting this vulnerability in the past 24 hours.

References

Share

Vulnerability Details for Redirection

Redirection

Software Type Plugin
Software Slug redirect-redirection (view on wordpress.org)
Patched? Yes
Remediation Update to version 1.1.4, or a newer patched version
Affected Version
  • <= 1.1.3
Patched Version
  • 1.1.4

Recent vulnerabilities in Redirection

Inisev Analyst Module <= Various Versions - Missing Authorization
4.3
CVE-2024-31435
Apr 10, 2024
Researcher: Dhabaleshwar Das
Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function
4.3
CVE-2023-0958
Jul 27, 2023
Researcher: Chloe Chamberland
Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function
4.3
CVE-2023-3977
Jul 27, 2023
Researcher: Chloe Chamberland
Redirection <= 1.1.4 - Cross-Site Request Forgery to Plugin Reset
5.4
CVE-2023-1331
Mar 21, 2023
Researcher: Mohamed Selim
Redirect Redirection <= 1.1.4 - Cross-Site Request Forgery to Plugin De-Installation
5.4
CVE ID Unknown
Mar 14, 2023
Researchers:
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'addRedirect' function
4.3
CVE-2023-1330
Feb 22, 2023
Researcher: Mohamed Selim
Redirect Redirection <= 1.1.3 - Missing Authorization in 'LoadTab' function
4.3
CVE ID Unknown
Feb 22, 2023
Researchers:
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'instantEditRedirect' function
4.3
CVE ID Unknown
Feb 21, 2023
Researchers:
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'SaveSettings' function
4.3
CVE ID Unknown
Feb 21, 2023
Researchers:
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'saveRedirectSettings' function
4.3
CVE ID Unknown
Feb 21, 2023
Researchers:
# Title CVE ID CVSS Researchers Date
1 Inisev Analyst Module <= Various Versions - Missing Authorization CVE-2024-31435 4.3 Dhabaleshwar Das April 10, 2024
2 Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function CVE-2023-0958 4.3 Chloe Chamberland July 27, 2023
3 Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function CVE-2023-3977 4.3 Chloe Chamberland July 27, 2023
4 Redirection <= 1.1.4 - Cross-Site Request Forgery to Plugin Reset CVE-2023-1331 5.4 Mohamed Selim March 21, 2023
5 Redirect Redirection <= 1.1.4 - Cross-Site Request Forgery to Plugin De-Installation 5.4 March 14, 2023
6 Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'addRedirect' function CVE-2023-1330 4.3 Mohamed Selim February 22, 2023
7 Redirect Redirection <= 1.1.3 - Missing Authorization in 'LoadTab' function 4.3 February 22, 2023
8 Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'instantEditRedirect' function 4.3 February 21, 2023
9 Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'SaveSettings' function 4.3 February 21, 2023
10 Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'saveRedirectSettings' function 4.3 February 21, 2023
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation