# All 404 Redirect to Homepage <= 5.7 - Unauthenticated Uncontrolled Resource Consumption via 404 Logging

- **ID:** WPSEC-2026-1646
- **Plugin:** All 404 Redirect to Homepage (`all-404-redirect-to-homepage`), https://wordpress.org/plugins/all-404-redirect-to-homepage/
- **Affected versions:** all versions before 5.8
- **Fixed in:** 5.8 (Update to 5.8 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- **Weakness:** CWE-770
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/all-404-redirect-to-homepage
- **Fix released:** 2026-10-24
- **Published:** 2026-10-25
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1646/

## Description

The All 404 Redirect to Homepage plugin for WordPress is vulnerable to Uncontrolled Resource Consumption via its 404 logging feature in all versions up to, and including, 5.7. This is due to every 404 request writing a new log row for each unique URL, with no limit on URL length, no row cap, no retention pruning and no way to switch logging off, plus a write to the plugin's options on every request. This makes it possible for unauthenticated attackers to flood the database by requesting large numbers of unique non-existent URLs, growing the log table without bound and degrading site performance or exhausting storage.

## References

- https://wpsec.com/vuln/WPSEC-2026-1646/
- https://plugins.svn.wordpress.org/all-404-redirect-to-homepage/tags/5.8/
- https://wordpress.org/plugins/all-404-redirect-to-homepage/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1646/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.