What’s Vulnerable › Vulnerabilities

CVE-2021-24354: Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin Installation

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-14 · updated 2026-06-17
• Weakness: CWE-862

Description

A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it possible for authenticated users to install arbitrary plugins on vulnerable sites.

Affected products

• Simple 301 Redirects by BetterLinks: from 2.0.0 before 2.0.4 — fixed in 2.0.4

How to fix

Upgrade to a fixed version: Simple 301 Redirects by BetterLinks 2.0.4. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/8638b36c-6641-491f-b9df-5db3645e4668
• https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/
• https://wpscan.com/vulnerability/8638b36c-6641-491f-b9df-5db3645e4668
• https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/

Get alerted when CVE-2021-24354 or the next vulnerability affects your stack