CVE-2021-24356: Wpdeveloper Simple 301 Redirects

High severity, CVSS 8.8. EPSS: 2.6% chance of exploitation in the next 30 days.

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites.

Affected products

• Wpdeveloper Simple 301 Redirects: from 2.0.0, before 2.0.4 (fixed in 2.0.4)

Published 2021-06-14. Last modified 2026-06-17.