CVE-2026-7562 Details
Description
The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due to the absence of a nonce field in the admin settings form and the lack of any nonce verification (via check_admin_referer() or wp_verify_nonce()) in the displayWPRedirectionManagementPage() function before processing POST requests that add, edit, or delete URL redirection rules. This makes it possible for unauthenticated attackers to trick a logged-in administrator into clicking a crafted link, causing the attacker to create, modify, or delete redirection records in the plugin's database table without the administrator's consent.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WP-Redirection plugin for WordPress, affecting all versions up to and including 1.0.3. The vulnerability arises from the lack of a nonce field in the admin settings form and the absence of nonce verification in the 'displayWPRedirectionManagementPage()' function. This oversight allows unauthenticated attackers to manipulate logged-in administrators into clicking malicious links, which can result in unauthorized creation, modification, or deletion of URL redirection rules in the plugin's database.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://plugins.trac.wordpress.org/browser/wp-redirection/tags/1.0.3/wp-redirection.php#L219 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/wp-redirection/tags/1.0.3/wp-redirection.php#L39 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/wp-redirection/trunk/wp-redirection.php#L219 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/wp-redirection/trunk/wp-redirection.php#L39 | [email protected] | Source CodeVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/15177d1b-ef48-49e3-9bd9-34262ed2c134?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WP-Redirection | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |