CVE-2019-19915: webfactoryltd 301_redirects Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2019-19915 is a critical (CVSS 9.0) Cross-Site Request Forgery (CSRF) vulnerability in webfactoryltd 301_redirects. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 57.8% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 19-12-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete actions. This could result in a loss of site availability, malicious redirects, and user infections. This could also be exploited via CSRF.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.