WP-Redirection <= 1.0.3 - Cross-Site Request Forgery to Settings Update
mediumThe WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due to the absence of a nonce field in the admin settings form and the lack of any nonce verification (via check_admin_referer() or wp_verify_nonce()) in the displayWPRedirectionManagem...
- CVSS:
- 4.3
- Affected:
- up to 1.0.3
- Fix:
- No patched version reported
- Disclosed:
- May 11, 2026