CVE-2021-24353
published 2021-06-14CVE-2021-24353: The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for…
PriorityP274high8.8CVSS 3.1
AVNACLPRNUIRSCCLILAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.11%
61.7th percentile
The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wpdeveloper | simple_301_redirects | >= 2.0.0 < 2.0.4 | 2.0.4 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jpx5-rg85-r3xv: The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2
ghsa_unreviewed·2022-05-24
CVE-2021-24353 [HIGH] CWE-284 GHSA-jpx5-rg85-r3xv: The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2
The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.
VulnCheck
wpdeveloper simple_301_redirects Missing Authorization
vulncheck·2021·CVSS 8.8
CVE-2021-24353 [HIGH] wpdeveloper simple_301_redirects Missing Authorization
wpdeveloper simple_301_redirects Missing Authorization
The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.
Affected: wpdeveloper simple_301_redirects
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/simple-301-redirects/simple-301-redirects-200-203-unauthenticated-redirect-import
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://wpscan.com/vulnerability/74c23d56-e81f-47e9-bf8b-33d3f0e81894https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/https://wpscan.com/vulnerability/74c23d56-e81f-47e9-bf8b-33d3f0e81894https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/
2021-06-14
Published
Exploited in the wild