What is the CVSS score of CVE-2026-7562?

CVE-2026-7562 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WP-Redirection WordPress Plugin CVE-2026-7562

EUVD-2026-29417 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-12 Wordfence

GHSA-99c9-fq53-p5w8

CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:46 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due to the absence of a nonce field in the admin settings form and the lack of any nonce verification (via check_admin_referer() or wp_verify_nonce()) in the displayWPRedirectionManagementPage() function before processing POST requests that add, edit, or delete URL redirection rules. This makes it possible for unauthenticated attackers to trick a logged-in administrator into clicking a crafted link, causing the attacker to create, modify, or delete redirection records in the plugin's database table without the administrator's consent.

AnalysisAI

Cross-Site Request Forgery in WP-Redirection plugin for WordPress versions up to 1.0.3 allows unauthenticated attackers to trick logged-in administrators into modifying redirection rules by clicking a crafted link, enabling unauthorized creation, modification, or deletion of URL redirects without consent. The vulnerability stems from missing nonce validation in the admin settings form handler, affecting all installations running vulnerable versions.

Technical ContextAI

WP-Redirection is a WordPress plugin that manages URL redirection rules stored in the plugin's database table. The vulnerability exists in the displayWPRedirectionManagementPage() function, which processes POST requests to add, edit, or delete redirection records without verifying CSRF tokens (nonce fields). WordPress provides two standard CSRF protection mechanisms - wp_nonce_field() for output and check_admin_referer() or wp_verify_nonce() for validation - both of which are absent from this plugin. CWE-352 (Cross-Site Request Forgery) indicates the root cause is the failure to implement state-changing request validation, a critical requirement for admin functionality in WordPress plugins.

RemediationAI

Update WP-Redirection to a patched version released after 1.0.3 (check the official WordPress plugin repository at https://plugins.wordpress.org/wp-redirection/ for the latest available release). Until a patch is available, disable the WP-Redirection plugin if not actively in use, or restrict admin access to trusted users only and review redirect rules for unauthorized modifications. If the plugin must remain active, implement additional CSRF mitigation at the web server level using CSP (Content-Security-Policy) headers with frame-ancestors or X-Frame-Options to prevent the admin interface from being embedded in malicious pages, though this does not fully prevent CSRF attacks on same-origin requests. Monitor WordPress admin audit logs for suspicious additions or deletions of redirection rules. Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/15177d1b-ef48-49e3-9bd9-34262ed2c134 provides additional context and may include updated patch information.