CVE-2026-13703: SEO Redirection Plugin Info Disclosure

CVE-2026-13703 Overview

CVE-2026-13703 affects the SEO Redirection Plugin for WordPress in versions prior to 9.19. The plugin fails to perform a capability check in one of its authenticated AJAX actions. Any logged-in user, including low-privilege subscribers, can invoke the action and read the site's configured 301 redirect rules. The disclosed data includes both source and destination URLs stored by the plugin. This is a missing authorization flaw that leads to information disclosure across all sites running vulnerable versions of the plugin.

Critical Impact
Authenticated subscriber-level accounts can enumerate all 301 redirect rules, exposing internal URL structures, staging paths, and marketing redirect targets.

Affected Products

SEO Redirection Plugin for WordPress versions before 9.19
WordPress sites with subscriber registration or higher-privileged accounts enabled
Any deployment relying on the plugin's default AJAX action handlers

Discovery Timeline

2026-08-06 - CVE-2026-13703 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-13703

Vulnerability Analysis

The vulnerability is a broken access control issue in an authenticated AJAX endpoint exposed by the SEO Redirection Plugin. WordPress plugins register AJAX actions through the wp_ajax_{action} hook, which authenticates the caller but does not enforce role-based authorization. The plugin registers a handler that returns configured redirect rules without validating the caller's capabilities. Any authenticated user session, including a subscriber created through open registration, can trigger the handler. The response body contains the full list of 301 redirects, including both source and destination URLs.

Root Cause

The plugin's AJAX callback omits a current_user_can() check before returning redirect data. WordPress requires plugin authors to explicitly verify capabilities such as manage_options inside privileged handlers. Without this check, authentication alone is treated as authorization. This pattern maps to CWE-862 (Missing Authorization).

Attack Vector

An attacker registers or compromises a low-privilege account on the target WordPress site. The attacker then issues an authenticated POST request to wp-admin/admin-ajax.php invoking the vulnerable action. The server returns the redirect rule set in the response body. Exposed redirect maps can reveal legacy URLs, hidden landing pages, campaign infrastructure, and internal reorganization paths that assist reconnaissance for further attacks.

No verified public exploit code is available. See the WPScan Vulnerability Advisory for technical details.

Detection Methods for CVE-2026-13703

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php originating from subscriber-level sessions
AJAX responses containing arrays of URL pairs returned to non-administrative users
Spikes in requests to the SEO Redirection Plugin's AJAX action from a single authenticated session

Detection Strategies

Review web server access logs for admin-ajax.php traffic tied to accounts that do not perform administrative work
Correlate the action parameter in admin-ajax requests against expected caller roles
Alert on newly registered subscriber accounts that immediately issue admin-ajax requests

Monitoring Recommendations

Enable WordPress audit logging for AJAX action invocations and user role usage
Forward WordPress and web server logs to a centralized analytics platform for correlation
Track the installed version of the SEO Redirection Plugin across managed sites and flag versions below 9.19

How to Mitigate CVE-2026-13703

Immediate Actions Required

Update the SEO Redirection Plugin to version 9.19 or later on every WordPress instance
Audit existing user accounts and remove unused subscriber or contributor accounts
Disable open user registration if it is not required for site functionality

Patch Information

The plugin vendor addressed the issue in version 9.19 by adding a capability check to the affected AJAX action. Administrators should upgrade through the WordPress plugin manager or replace the plugin directory with the patched release. Confirm the installed version matches 9.19 or higher after upgrade. Refer to the WPScan Vulnerability Advisory for advisory details.

Workarounds

Restrict admin-ajax.php access via web application firewall rules that block the vulnerable action for non-administrator sessions
Temporarily deactivate the SEO Redirection Plugin until the patched version can be deployed
Set WordPress registration to require manual approval to reduce the pool of authenticated attackers

bash

# Verify the installed plugin version via WP-CLI
wp plugin get seo-redirection --field=version

# Update the plugin to the patched release
wp plugin update seo-redirection --version=9.19