CVE-2021-24853: QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-17 · updated 2026-06-17
Weakness: CWE-284

Description

The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects

Affected products

QR Redirector: before 1.6 — fixed in 1.6

How to fix

Upgrade to a fixed version: QR Redirector 1.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/240bed24-0315-4bbf-ba17-e4947e5ecacb
https://wpscan.com/vulnerability/240bed24-0315-4bbf-ba17-e4947e5ecacb

Get alerted when CVE-2021-24853 or the next vulnerability affects your stack