CVE-2019-19915
published 2019-12-19CVE-2019-19915: The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject…
PriorityP272critical9CVSS 3.1
AVNACLPRLUIRSCCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.86%
53.9th percentile
The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete actions. This could result in a loss of site availability, malicious redirects, and user infections. This could also be exploited via CSRF.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| webfactoryltd | 301_redirects | < 2.45 | 2.45 |
CVSS provenance
nvdv3.19.0CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
nvdv3.09.0CRITICALCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
vulncheck9.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r8f7-ff3w-94hq: The "301 Redirects - Easy Redirect Manager" plugin before 2
ghsa_unreviewed·2022-05-24
CVE-2019-19915 [MEDIUM] GHSA-r8f7-ff3w-94hq: The "301 Redirects - Easy Redirect Manager" plugin before 2
The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete actions. This could result in a loss of site availability, malicious redirects, and user infections. This could also be exploited via CSRF.
VulnCheck
webfactoryltd 301_redirects Cross-Site Request Forgery (CSRF)
vulncheck·2019·CVSS 9.0
CVE-2019-19915 [CRITICAL] webfactoryltd 301_redirects Cross-Site Request Forgery (CSRF)
webfactoryltd 301_redirects Cross-Site Request Forgery (CSRF)
The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete actions. This could result in a loss of site availability, malicious redirects, and user infections. This could also be exploited via CSRF.
Affected: webfactoryltd 301_redirects
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/eps-301-redirects
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://wpvulndb.com/vulnerabilities/9979https://www.wordfence.com/blog/2019/12/critical-vulnerability-patched-in-301-redirects-easy-redirect-manager/https://wpvulndb.com/vulnerabilities/9979https://www.wordfence.com/blog/2019/12/critical-vulnerability-patched-in-301-redirects-easy-redirect-manager/
2019-12-19
Published
Exploited in the wild