Authorization Bypass Vulnerability in Quick Page/Post Redirect Plugin for WordPress

CVE-2020-36699

Summary

The Quick Page/Post Redirect Plugin for WordPress is susceptible to an authorization bypass due to inadequate capability checks in the qppr_save_quick_redirect_ajax and qppr_delete_quick_redirect functions. This flaw, present in versions 5.1.9 and earlier, allows low-privileged attackers to manipulate plugin settings. Consequently, they can create redirect links that direct users to malicious external websites, posing significant risks to website integrity and user safety.

References