Read the docs
TI-2021-06647 Aliases CVE-2021-24355GHSA-x56p-hv7c-cxvx

Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Update and Retrieve Wildcard Value

Priority LOW 21CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simple301redirects/admin/get_wildcard and simple301redirects/admin/wildcard, made it possible for authenticated users to retrieve and update the wildcard value for redirects.

Why it matters now

EPSS 0.0072 54th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Simple 301 Redirects by BetterLinks (Unknown): 2.0.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSimple 301 Redirects by BetterLinks2.0.0 and later; 2.0.4 to before 2.0.42.0.4Patch availableCNA
  • Simple 301 Redirects by BetterLinks VendorUnknown Affected 2.0.0 and later; 2.0.4 to before 2.0.4 Fixed in 2.0.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpdeveloper:simple_301_redirects:*:*:*:*:*:wordpress:*:*2.0.0 to before 2.0.4Vulnerablewpdevteam
  • cpe:2.3:a:wpdeveloper:simple_301_redirects:*:*:*:*:*:wordpress:*:* Versions 2.0.0 to before 2.0.4 Vulnerable ·wpdevteam

Remediation

  • Fix · CNA Simple 301 Redirects by BetterLinks (Unknown) Fixed in 2.0.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Simple 301 Redirects by BetterLinks 2.0.0*, 2.0.4

    5 records Highest priority Priority MEDIUM 4 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-06648 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin ActivationPriority MEDIUM 43
    • TI-2021-06646 Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin InstallationPriority MEDIUM 41
    • TI-2021-06645 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect ImportPriority MEDIUM 40
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24355
  2. 2026-10-03 Alias added: GHSA-x56p-hv7c-cxvx

References

Exploit 2

  • TI-2021-06648 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin Activation CVSS 3.1HIGH 8.8
  • TI-2021-06646 Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin Installation CVSS 3.1HIGH 8.8
  • TI-2021-06645 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Import CVSS 3.1HIGH 8.8
  • TI-2021-06644 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Export CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences