CVE-2026-49067: Advanced 301 and 302 Redirect SQLi Flaw

CVE-2026-49067 Overview

CVE-2026-49067 is an unauthenticated SQL injection vulnerability affecting the Advanced 301 and 302 Redirect WordPress plugin in versions up to and including 1.6.9. The flaw is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Remote attackers can send crafted requests to the vulnerable plugin endpoints without authentication and inject arbitrary SQL into backend database queries. Successful exploitation can expose database contents, leak sensitive configuration data, and degrade site availability. The vulnerability was published to the National Vulnerability Database (NVD) on June 15, 2026.

Critical Impact
Unauthenticated attackers can inject SQL statements over the network against any WordPress site running Advanced 301 and 302 Redirect 1.6.9 or earlier, leading to confidentiality loss and partial availability impact.

Affected Products

Advanced 301 and 302 Redirect WordPress plugin versions <= 1.6.9
WordPress sites that have the plugin installed and activated
Any hosting environment exposing the affected plugin endpoints to the internet

Discovery Timeline

2026-06-15 - CVE-2026-49067 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49067

Vulnerability Analysis

The vulnerability is a SQL injection flaw in the Advanced 301 and 302 Redirect plugin for WordPress. The plugin manages HTTP 301 and 302 redirects by reading and writing rule data to the WordPress database. One or more code paths concatenate user-controlled input directly into SQL statements without using parameterized queries or the WordPress $wpdb->prepare() API.

Because the affected endpoint does not require authentication, an attacker only needs network reachability to the WordPress site. The attack complexity is low and no user interaction is required. The scope is changed, meaning the impact extends beyond the vulnerable component into the broader database context. Confidentiality impact is high while availability impact is partial.

See the Patchstack Vulnerability Report for full technical details.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands. The plugin accepts attacker-controlled values from HTTP request parameters and interpolates them into SQL queries executed against the WordPress database. Without prepared statements or input sanitization, characters such as single quotes, comments, and UNION keywords reach the SQL engine intact.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to a vulnerable plugin endpoint on an exposed WordPress site. The injected SQL payload alters the original query logic, enabling UNION-based extraction of data from wp_users, wp_options, or other sensitive tables. Time-based or boolean-based blind injection techniques are also possible where direct output is suppressed.

No verified public exploitation code is available for CVE-2026-49067 at the time of publication. The vulnerability mechanism follows standard WordPress plugin SQL injection patterns documented in the referenced Patchstack advisory.

Detection Methods for CVE-2026-49067

Indicators of Compromise

HTTP requests to Advanced 301 and 302 Redirect plugin endpoints containing SQL syntax such as UNION SELECT, SLEEP(, BENCHMARK(, or encoded variants
Web server access logs showing repeated requests with unusual query string parameters targeting plugin URLs under /wp-content/plugins/advanced-301-and-302-redirect/
Database error messages appearing in PHP logs referencing syntax errors near attacker-supplied input
Anomalous outbound database query patterns or sudden spikes in query duration

Detection Strategies

Inspect web application firewall (WAF) logs for SQL injection signatures targeting WordPress plugin paths
Correlate HTTP 500 responses with subsequent requests from the same source IP to identify probing attempts
Monitor for unauthenticated requests issuing high volumes of parameterized queries to redirect plugin endpoints

Monitoring Recommendations

Enable verbose logging on the WordPress $wpdb layer or via a database proxy to capture full query text
Forward web server, PHP, and MySQL logs into a centralized analytics platform with retention sufficient for incident response
Alert on access to wp_users table reads originating from front-end PHP workers outside normal authentication flows

How to Mitigate CVE-2026-49067

Immediate Actions Required

Identify all WordPress installations running the Advanced 301 and 302 Redirect plugin and confirm installed versions
Deactivate and remove the plugin on any site running version <= 1.6.9 until a patched release is verified
Review database logs and wp_users records for evidence of unauthorized access or credential theft
Rotate WordPress administrator passwords and secret keys defined in wp-config.php if compromise is suspected

Patch Information

No vendor patch is referenced in the available data. Site operators should monitor the Patchstack Vulnerability Report and the official WordPress plugin repository for an updated release beyond version 1.6.9. Apply the patched version immediately upon availability.

Workarounds

Remove the plugin entirely and replace redirect functionality with server-level rules in .htaccess or nginx.conf
Deploy a WAF rule blocking SQL metacharacters in requests to the plugin's URL path
Restrict access to plugin endpoints by IP allow-list where redirects are managed by a small administrator group

bash

# Example nginx rule blocking access to the vulnerable plugin path
location ~* /wp-content/plugins/advanced-301-and-302-redirect/ {
    deny all;
    return 403;
}