QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update
Priority LOW 20CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass, Tampering
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284 and CWE-352.
Summary
The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects
Why it matters now
EPSS 0.00447 39th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed QR Redirector (Unknown): 1.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | QR Redirector | 1.6 to before 1.6 | 1.6 | Patch available | CNA |
- QR Redirector VendorUnknown Affected 1.6 to before 1.6 Fixed in 1.6 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:qr_redirector_project:qr_redirector:*:*:*:*:*:wordpress:*:* | before 1.6 | Vulnerable | Qr Redirector Project |
- cpe:2.3:a:qr_redirector_project:qr_redirector:*:*:*:*:*:wordpress:*:* Versions before 1.6 Vulnerable ·Qr Redirector Project
Remediation
- Fix · CNA QR Redirector (Unknown) Fixed in 1.6
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24853
- 2026-10-03 Alias added: GHSA-gg89-hw93-j4hc
References
More Qr Redirector Project Qr Redirector vulnerabilities
- TI-2021-07136 QR Redirector < 1.6.1 - Contributor+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.4
Sources
- CVE-2021-24853 · CVE Program
- CVE-2021-24853 · NVD
- FIRST EPSS
- GHSA-gg89-hw93-j4hc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences