CVE-2024-11341: Simple Redirection Plugin CSRF Vulnerability

CVE-2024-11341 Overview

The Simple Redirection plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.5. The flaw exists in the settings_page() function, which lacks proper nonce validation. Unauthenticated attackers can craft malicious requests that modify the plugin's redirection settings when a site administrator is tricked into clicking a crafted link. A successful attack redirects all site visitors to an attacker-controlled destination. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows attackers to hijack site redirection settings, sending every visitor to arbitrary destinations for phishing, malware distribution, or SEO poisoning campaigns.

Affected Products

Simple Redirection plugin for WordPress (all versions up to and including 1.5)
WordPress sites running the vulnerable plugin with administrator sessions
Any site visitor whose traffic is redirected after successful exploitation

Discovery Timeline

2024-12-05 - CVE-2024-11341 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11341

Vulnerability Analysis

The Simple Redirection plugin exposes a settings page handled by the settings_page() function. This function processes state-changing requests without verifying a WordPress nonce token. Nonces are the standard WordPress mechanism for confirming that a request originated from a legitimate, authenticated user interface interaction.

Because the check is missing or incorrectly implemented, the plugin cannot distinguish between a legitimate administrator submission and a forged request delivered through the administrator's browser. An attacker who convinces an authenticated administrator to visit a malicious page can trigger settings updates using the administrator's session cookies.

Exploitation requires user interaction from a privileged account but no authentication on the attacker's side. The impact is limited to integrity of plugin configuration, though the downstream effect on site visitors is significant.

Root Cause

The root cause is missing or incorrect nonce validation in the settings_page() function. WordPress provides wp_verify_nonce() and check_admin_referer() for this purpose. The plugin fails to call these functions, or calls them without enforcing the result before applying settings changes.

Attack Vector

The attack requires an authenticated WordPress administrator to interact with attacker-controlled content, typically a link or embedded resource on a page the administrator visits while logged into the WordPress admin panel. The attacker's page issues a crafted HTTP request to the plugin's settings endpoint. Because the browser automatically attaches the administrator's session cookie and no nonce is validated server-side, the plugin accepts the forged input and updates the redirection URL. All subsequent visitors to the WordPress site are redirected to the attacker's chosen destination. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-11341

Indicators of Compromise

Unexpected changes to Simple Redirection plugin settings, particularly the destination URL
Site visitors reporting redirection to unfamiliar external domains
Administrator activity in access logs immediately preceded by referer headers from untrusted external sites
Outbound HTTP 3xx responses from the WordPress site pointing to unknown domains

Detection Strategies

Monitor WordPress wp-admin POST requests to Simple Redirection settings endpoints and correlate them with the referer and originating IP
Alert on modifications to the plugin's stored options in the wp_options table when no corresponding administrator login session is active
Baseline the redirection destination URL and trigger notifications when the value changes

Monitoring Recommendations

Enable WordPress audit logging to capture plugin settings changes with user attribution and timestamps
Forward web server access logs and WordPress activity logs into a centralized SIEM for correlation across sessions and requests
Review browser and endpoint telemetry from administrator workstations for visits to suspicious pages preceding configuration changes

How to Mitigate CVE-2024-11341

Immediate Actions Required

Update the Simple Redirection plugin to a version later than 1.5 that includes the nonce validation fix
Audit current plugin settings and confirm the configured redirection URL matches the intended destination
Force administrator session logouts and rotate credentials if unauthorized settings changes are found

Patch Information

The fix was committed in the plugin's source repository as documented in the WordPress Plugin Changeset 3201717. The patch adds proper nonce verification to the settings_page() handler, ensuring that requests to modify redirection configuration originate from an authenticated administrator interacting with the plugin's own admin UI.

Workarounds

Deactivate the Simple Redirection plugin until it can be updated to a patched version
Restrict administrator browser sessions by using a dedicated browser profile that does not visit untrusted external sites while logged into WordPress
Deploy a web application firewall rule that blocks POST requests to the plugin's settings endpoint when the referer header is missing or points to an external origin

bash

# Example WAF rule concept for blocking off-origin POSTs to the plugin settings page
# Adjust the endpoint path to match the plugin's actual admin route
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1011341,phase:2,deny,status:403,msg:'CVE-2024-11341 CSRF attempt on Simple Redirection'"
  SecRule REQUEST_URI "@contains simple-redirection" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example/wp-admin/"