Read the docs
TI-2021-06645 Aliases CVE-2021-24353GHSA-jpx5-rg85-r3xv

Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Import

Priority MEDIUM 40CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.

Why it matters now

EPSS 0.01112 66th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Simple 301 Redirects by BetterLinks (Unknown): 2.0.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSimple 301 Redirects by BetterLinks2.0.0 and later; 2.0.4 to before 2.0.42.0.4Patch availableCNA
  • Simple 301 Redirects by BetterLinks VendorUnknown Affected 2.0.0 and later; 2.0.4 to before 2.0.4 Fixed in 2.0.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpdeveloper:simple_301_redirects:*:*:*:*:*:wordpress:*:*2.0.0 to before 2.0.4Vulnerablewpdevteam
  • cpe:2.3:a:wpdeveloper:simple_301_redirects:*:*:*:*:*:wordpress:*:* Versions 2.0.0 to before 2.0.4 Vulnerable ·wpdevteam

Remediation

  • Fix · CNA Simple 301 Redirects by BetterLinks (Unknown) Fixed in 2.0.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Simple 301 Redirects by BetterLinks 2.0.0*, 2.0.4

    5 records Highest priority Priority MEDIUM 4 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-06648 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin ActivationPriority MEDIUM 43
    • TI-2021-06646 Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin InstallationPriority MEDIUM 41
    • TI-2021-06644 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect ExportPriority MEDIUM 40
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24353
  2. 2026-10-03 Alias added: GHSA-jpx5-rg85-r3xv

References

Exploit 2

  • TI-2021-06648 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin Activation CVSS 3.1HIGH 8.8
  • TI-2021-06646 Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin Installation CVSS 3.1HIGH 8.8
  • TI-2021-06644 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Export CVSS 3.1HIGH 8.8
  • TI-2021-06647 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Update and Retrieve Wildcard Value CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences