Threat Investigation
Request a demo

CVE-2019-19915

Critical

Description

The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete actions. This could result in a loss of site availability, malicious redirects, and user infections. This could also be exploited via CSRF.

SeverityCritical
CVSS9.0
Exploit probability—
ProductWebfactoryltd 301 Redirects
PublishedDec 19, 2019
First seenDec 19, 2019

How to fix

Update
  • webfactoryltd 301_redirects2.45 or later

Affected products

ProductAffected versionsFixed in
webfactoryltd 301_redirectsv < 2.452.45

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.