All 404 Redirect to Homepage <= 5.7 - Unauthenticated Uncontrolled Resource Consumption via 404 Logging
- ID
- WPSEC-2026-1646
- Plugin
- All 404 Redirect to Homepage (all-404-redirect-to-homepage)
- Affected
- all versions before 5.8
- Remediation
- Update to 5.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness
- CWE-770
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- All 404 Redirect to Homepage on WPSec AttackSurface
- Fix released
- Published
Description
The All 404 Redirect to Homepage plugin for WordPress is vulnerable to Uncontrolled Resource Consumption via its 404 logging feature in all versions up to, and including, 5.7. This is due to every 404 request writing a new log row for each unique URL, with no limit on URL length, no row cap, no retention pruning and no way to switch logging off, plus a write to the plugin's options on every request. This makes it possible for unauthenticated attackers to flood the database by requesting large numbers of unique non-existent URLs, growing the log table without bound and degrading site performance or exhausting storage.
References
- https://wpsec.com/vuln/WPSEC-2026-1646/
- https://plugins.svn.wordpress.org/all-404-redirect-to-homepage/tags/5.8/
- https://wordpress.org/plugins/all-404-redirect-to-homepage/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS