Hidden Update Mechanism in Quick Page/Post Redirect Plugin for WordPress
CVE-2026-126697
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 14 November 2026
Badges
What is CVE-2026-126697?
The Quick Page/Post Redirect Plugin for WordPress prior to version 5.2.4 had a hidden update mechanism that allowed it to receive updates from a malicious server instead of WordPress.org. This oversight enabled attackers to push a compromised version that injected arbitrary content into web pages. Specifically, sites running version 5.2.1 were particularly at risk as they were misled by a matching version string to continue receiving updates from an unauthorized source, paving the way for spam injections and potential data breaches. To mitigate risks, it is crucial for site administrators to promptly remove the affected plugin, restore to the secure version from WordPress.org, and conduct thorough security checks.
Affected Version(s)
Quick Page/Post Redirect Plugin 5.2.1 < 5.2.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.