Redirection <= 5.10.0 - Unauthenticated CSV Injection via 404 and Redirect Log Exports
- ID
- WPSEC-2026-0208
- Plugin
- Redirection (redirection)
- Affected
- all versions before 5.10.1
- Remediation
- Update to 5.10.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-1236
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Redirection on WPSec AttackSurface
- Fix released
- Published
Description
The Redirection plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 5.10.0. The 404 and redirect log exports were written with a backslash CSV escape character, so a logged value containing a backslash followed by a double quote could end its quoted field early and start a new field that the plugin's formula escaping never checked (versions before 5.8.1 did not escape formulas at all). This makes it possible for unauthenticated attackers to place formulas in the requested URL, referrer or user agent of a logged request, which run when an administrator exports the logs and opens the CSV file in a spreadsheet application.
References
- https://wpsec.com/vuln/WPSEC-2026-0208/
- https://plugins.svn.wordpress.org/redirection/tags/5.10.1/
- https://wordpress.org/plugins/redirection/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS