nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-19915 CVE-2019-19915
CRITICAL
webfactoryltd 301_redirects Cross-Site Request Forgery (CSRF)
Record summary
CVE-2019-19915 has a selected CVSS score of 9.0 (critical).
Description
The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete actions. This could result in a loss of site availability, malicious redirects, and user infections. This could also be exploited via CSRF.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Dec 19, 2019 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
301_redirectsBrowse webfactoryltd / 301_redirects | VulnCheck | Version data not supplied | |
References
3wpvulndb.com
https://wpvulndb.com/vulnerabilities/9979 wordfence.com
https://www.wordfence.com/blog/2019/12/critical-vulnerability-patched-in-301-redirects-easy-redirect-manager