CVEvulnerability
CVE-2021-24354
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-06-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-862
Description
A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it possible for authenticated users to install arbitrary plugins on vulnerable sites.
Affected configurations
• wpdeveloper simple 301 redirects (>= 2.0.0 < 2.0.4)
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://wpscan.com/vulnerability/8638b36c-6641-491f-b9df-5db3645e4668 Exploit, Third Party Advisory
- https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/ Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/8638b36c-6641-491f-b9df-5db3645e4668 Exploit, Third Party Advisory
- https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/ Exploit, Third Party Advisory