CVE-2021-24356

Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin Activation

State: Published
Severity: Not scored
Published: Jun 14, 2021
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites.

Scores

The record has no CVSS score.

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
Simple 301 Redirects by BetterLinksUnknown	2.0.0 to before 2.0.0*Affected 2.0.4 to before 2.0.4Affected

References

https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/
https://wpscan.com/vulnerability/be356530-5e00-4f27-8177-b80f3c1ae6e8

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.