# Simple 301 Redirects by BetterLinks <= 2.1.0 - Unauthenticated PHP Object Injection via Insecure Plugin Information Request

- **ID:** WPSEC-2026-1073
- **Plugin:** Simple 301 Redirects by BetterLinks – Easy Redirect Manager (`simple-301-redirects`), https://wordpress.org/plugins/simple-301-redirects/
- **Affected versions:** from 2.0.0 before 2.1.1
- **Fixed in:** 2.1.1 (Update to 2.1.1 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-502
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-301-redirects
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1073/

## Description

The Simple 301 Redirects by BetterLinks plugin for WordPress is vulnerable to PHP Object Injection via the plugin information request made during BetterLinks installation in versions 2.0.0 up to, and including, 2.1.0, due to the get_remote_plugin_data function fetching plugin information from api.wordpress.org over plain HTTP and passing the response body to unserialize(). This makes it possible for unauthenticated attackers who can intercept or spoof that response, for example from a man-in-the-middle position or through DNS spoofing, to inject a PHP object when an administrator installs a plugin from the plugin's settings page. The same spoofed response can also point the installer to an attacker-supplied plugin package. Object injection on its own has no effect unless another installed plugin or theme provides a POP chain; with one, the attacker could delete files, retrieve sensitive data or execute code.

## References

- https://wpsec.com/vuln/WPSEC-2026-1073/
- https://plugins.svn.wordpress.org/simple-301-redirects/tags/2.1.1/
- https://wordpress.org/plugins/simple-301-redirects/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1073/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.