CVE-2021-24352
📋 TL;DR
This vulnerability allows unauthenticated attackers to export all redirect rules from WordPress sites using the Simple 301 Redirects by BetterLinks plugin. Any WordPress site with the vulnerable plugin version installed is affected, potentially exposing sensitive URL mapping information.
💻 Affected Systems
- Simple 301 Redirects by BetterLinks WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map internal site structure, discover hidden pages, or gather intelligence for further attacks by analyzing exported redirect rules.
Likely Case
Information disclosure of redirect configurations, potentially revealing internal URL structures or sensitive page locations.
If Mitigated
No impact if proper authentication and authorization controls are in place.
🎯 Exploit Status
Simple HTTP request to the vulnerable endpoint without authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.4
Vendor Advisory: https://wordpress.org/plugins/simple-301-redirects/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find Simple 301 Redirects by BetterLinks. 4. Click 'Update Now' or manually update to version 2.0.4 or later.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate simple-301-redirects
Block Vulnerable Endpoint
linuxBlock access to the export_data function via web server configuration
# Add to .htaccess for Apache: RewriteRule ^wp-content/plugins/simple-301-redirects/export_data - [F,L]
# Add to nginx config: location ~ /wp-content/plugins/simple-301-redirects/export_data { deny all; }
🧯 If You Can't Patch
- Remove the plugin entirely if patching is not possible
- Implement redirects at web server level instead of using plugin
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Simple 301 Redirects by BetterLinks versionCheck Version:
wp plugin get simple-301-redirects --field=versionVerify Fix Applied:
Verify plugin version is 2.0.4 or later in WordPress admin📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /wp-content/plugins/simple-301-redirects/export_data from unauthenticated users
- Unusual export requests to plugin endpoints
Network Indicators:
- GET requests to plugin export endpoints without authentication headers
SIEM Query:
source="web_logs" AND uri="/wp-content/plugins/simple-301-redirects/export_data" AND NOT user_agent="WordPress/*"🔗 References
- https://wpscan.com/vulnerability/d770f1fa-7652-465a-833c-b7178146847d
- https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/
- https://wpscan.com/vulnerability/d770f1fa-7652-465a-833c-b7178146847d
- https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/
