The WP-Redirection plugin for WordPress is vulnerable to cross‑site request forgery in all versions up to and including 1.0.3 because the admin settings form lacks a nonce field and does not validate it before processing POST requests to add, edit, or delete redirect rules. An attacker who can trick a logged‑in administrator into clicking a crafted link can cause the administrator to create, modify, or delete redirection entries in the plugin’s database. This compromises the integrity of site URLs and can be used to deface the site, redirect users to malicious destinations, or disrupt traffic flow. The vulnerability does not provide direct code execution or data exfiltration, but it does allow an attacker to alter critical site behavior without the administrator’s consent.

The affected product is the WordPress plugin WP‑Redirection (vendor phkcorp2005). All releases up to version 1.0.3 are vulnerable. No other products or versions are listed as affected.

The CVSS score of 4.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a CSRF exploit that requires the attacker to lure a logged‑in administrator to a malicious link; no additional privileges are needed. This makes the vulnerability moderately likely to be targeted, especially on high‑traffic sites that use WP‑Redirection for URL routing.