EUVD-2026-53737
GHSA-v7r8-6x26-q532
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Description confirms read-only access to redirect rules; I:N assigned as no modification capability is described, overriding NVD I:L.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in user such as a subscriber to read the site's configured 301 redirect rules, including their source and destination URLs.
AnalysisAI
Missing capability check in the SEO Redirection Plugin for WordPress (versions before 9.19) exposes authenticated AJAX endpoints to any logged-in user, regardless of role. A subscriber-level account - the lowest WordPress user tier - can invoke the unprotected action to enumerate all configured 301 redirect rules, revealing source and destination URLs that may disclose internal site architecture, campaign tracking patterns, or sensitive path structures. No public exploitation in the wild has been confirmed by CISA KEV, but a proof-of-concept is publicly available per WPScan, raising the probability of opportunistic abuse against unpatched sites.
Technical ContextAI
The vulnerability resides in a WordPress plugin that manages HTTP 301 permanent redirects for SEO purposes. WordPress AJAX handlers registered via wp_ajax_{action} are accessible to all authenticated users by default unless the handler explicitly calls current_user_can() or an equivalent capability check to restrict access by role. CWE-284 (Improper Access Control) identifies this pattern: the plugin registers an AJAX action intended for administrators but omits the authorization gate, so any user who can authenticate to wp-admin/admin-ajax.php - including subscribers with no administrative privileges - can trigger it. Affected CPE: cpe:2.3:a:unknown:seo_redirection_plugin:*:*:*:*:*:*:*:* covering all versions prior to 9.19.
RemediationAI
Upgrade the SEO Redirection Plugin to version 9.19 or later, which introduces the missing capability check on the affected AJAX action. This is the definitive fix; no workarounds replicate its effectiveness. If immediate patching is not possible, site administrators can restrict WordPress user registration to prevent untrusted parties from obtaining subscriber accounts, reducing the pool of potential exploiters - however, existing authenticated users would retain access. Additionally, a Web Application Firewall rule blocking direct POST requests to admin-ajax.php with the specific action parameter can serve as a temporary compensating control, though this requires identifying the action name from the WPScan advisory at https://wpscan.com/vulnerability/14eded96-f061-4220-af30-decb43b40e66/. Note that blocking admin-ajax.php broadly will break legitimate plugin functionality.
More in Seo Redirection Plugin
View allThe tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflec
The SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Red
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today