CVE-2026-7562

Name of the Vulnerable Software and Affected Versions WP-Redirection versions prior to 1.0.4

Description Cross-Site Request Forgery occurs because the admin settings form lacks a nonce field and the displayWPRedirectionManagementPage() function does not perform nonce verification via check admin referer() or wp verify nonce() before processing POST requests. This allows unauthenticated attackers to trick a logged-in administrator into clicking a crafted link to create, modify, or delete URL redirection records in the database without consent. A nonce is a unique token used to protect against request forgery by ensuring the request was intentionally sent by the user.

Recommendations Update to a version newer than 1.0.3.