Read the docs
TI-2021-06648 Aliases CVE-2021-24356GHSA-x8rw-vx6w-9xw8

Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin Activation

Priority MEDIUM 43CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites.

Why it matters now

EPSS 0.02604 85th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Simple 301 Redirects by BetterLinks (Unknown): 2.0.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSimple 301 Redirects by BetterLinks2.0.0 and later; 2.0.4 to before 2.0.42.0.4Patch availableCNA
  • Simple 301 Redirects by BetterLinks VendorUnknown Affected 2.0.0 and later; 2.0.4 to before 2.0.4 Fixed in 2.0.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpdeveloper:simple_301_redirects:*:*:*:*:*:wordpress:*:*2.0.0 to before 2.0.4Vulnerablewpdevteam
  • cpe:2.3:a:wpdeveloper:simple_301_redirects:*:*:*:*:*:wordpress:*:* Versions 2.0.0 to before 2.0.4 Vulnerable ·wpdevteam

Remediation

  • Fix · CNA Simple 301 Redirects by BetterLinks (Unknown) Fixed in 2.0.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Simple 301 Redirects by BetterLinks 2.0.0*, 2.0.4

    5 records Highest priority Priority MEDIUM 4 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-06646 Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin InstallationPriority MEDIUM 41
    • TI-2021-06645 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect ImportPriority MEDIUM 40
    • TI-2021-06644 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect ExportPriority MEDIUM 40
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24356
  2. 2026-10-03 Alias added: GHSA-x8rw-vx6w-9xw8

References

Exploit 2

  • TI-2021-06646 Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin Installation CVSS 3.1HIGH 8.8
  • TI-2021-06645 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Import CVSS 3.1HIGH 8.8
  • TI-2021-06644 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Export CVSS 3.1HIGH 8.8
  • TI-2021-06647 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Update and Retrieve Wildcard Value CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences