Simple 301 Redirects by BetterLinks <= 2.1.0 - Unauthenticated PHP Object Injection via Insecure Plugin Information Request
- ID
- WPSEC-2026-1073
- Plugin
- Simple 301 Redirects by BetterLinks – Easy Redirect Manager (simple-301-redirects)
- Affected
- from 2.0.0 before 2.1.1
- Remediation
- Update to 2.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- Simple 301 Redirects by BetterLinks on WPSec AttackSurface
- Fix released
- Published
Description
The Simple 301 Redirects by BetterLinks plugin for WordPress is vulnerable to PHP Object Injection via the plugin information request made during BetterLinks installation in versions 2.0.0 up to, and including, 2.1.0, due to the get_remote_plugin_data function fetching plugin information from api.wordpress.org over plain HTTP and passing the response body to unserialize(). This makes it possible for unauthenticated attackers who can intercept or spoof that response, for example from a man-in-the-middle position or through DNS spoofing, to inject a PHP object when an administrator installs a plugin from the plugin's settings page. The same spoofed response can also point the installer to an attacker-supplied plugin package. Object injection on its own has no effect unless another installed plugin or theme provides a POP chain; with one, the attacker could delete files, retrieve sensitive data or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-1073/
- https://plugins.svn.wordpress.org/simple-301-redirects/tags/2.1.1/
- https://wordpress.org/plugins/simple-301-redirects/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS