WordPress Plugin Vulnerabilities

SEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subscriber+ Redirect Rule Disclosure

Description

The plugin does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in user such as a subscriber to read the site's configured 301 redirect rules, including their source and destination URLs.

Proof of Concept

Affects Plugins

Plugin icon
seo-redirection
Fixed in 9.19

References

CVE
CVE-2026-13703
URL
https://wordpress.org/plugins/seo-redirection/

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
J4ck13Ch4n
Submitter
J4ck13Ch4n
Verified
Yes
WPVDB ID
14eded96-f061-4220-af30-decb43b40e66

Timeline

Publicly Published
2026-08-03 (about 3 days ago)
Added
2026-08-03 (about 2 days ago)
Last Updated
2026-08-03 (about 2 days ago)

Other

Published
Title
Published
2026-02-25
Title
User Registration & Membership < 5.1.3 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
Published
2021-09-21
Title
WP Mega Menu < 1.4.1 - Subscriber+ Arbitrary Post Access
Published
2022-02-02
Title
Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI
Published
2021-07-12
Title
Frontend File Manager < 18.3 - Unauthenticated Post Meta Change to Arbitrary File Download
Published
2021-07-12
Title
Frontend File Manager < 18.3 - Unauthenticated Arbitrary Post Deletion