CVE-2014-2598

Name of the Vulnerable Software and Affected Versions Quick Page/Post Redirect plugin versions prior to 5.0.5

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks. This is achieved via the quickppr redirects[request][] parameter in the "redirect-updates" page to "wp-admin/admin.php".

Recommendations For versions prior to 5.0.5, update to version 5.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the redirect-updates page in wp-admin/admin.php to minimize the risk of exploitation. Avoid using the quickppr redirects[request][] parameter in the affected page until the issue is resolved.