Atomic Edge analysis of CVE-2026-7561 (metadata-based): This vulnerability affects the Tm – WordPress Redirection plugin, version 1.2 and earlier. A Cross-Site Request Forgery (CSRF) flaw exists due to missing or incorrect nonce validation on a plugin function handling settings updates. This allows an unauthenticated attacker to forge requests that, when triggered by an authenticated administrator, can modify redirection settings and inject stored cross-site scripting (XSS) payloads. The CVSS score is 6.1 (Medium), with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Root Cause: The plugin likely registers an administrative action, probably via an AJAX handler or an admin-post hook, to save redirection rules or plugin settings. The function responsible for processing this action does not verify a WordPress nonce token before executing the update. Without nonce validation, the plugin accepts any incoming request matching the action name, trusting browser-sourced data. Since no code diff is available, Atomic Edge infers this pattern from the CWE-352 classification and the description’s mention of ‘missing or incorrect nonce validation on a function.’ The stored XSS component arises because the plugin either fails to sanitize user-supplied input when saving settings or fails to escape output when rendering the redirection rules in the admin dashboard.
Exploitation: An attacker crafts a malicious link or automatically submits a form from an external site. The request targets the plugin’s settings update endpoint. For typical WordPress plugins, this endpoint is either admin-ajax.php with action=tm_wordpress_redirection_save, or admin-post.php with action=tm_wordpress_redirection_update. The attacker includes parameters corresponding to redirection rules, such as source_url, target_url, and a JavaScript payload like “>alert(‘XSS’) or a more sophisticated payload that exfiltrates cookies or performs admin actions. The attacker then tricks a logged-in administrator into clicking the link or visiting the attacker-controlled page. The administrator’s browser automatically sends the forged request with cookies. The plugin saves the malicious settings without checking the nonce, resulting in stored XSS that triggers when the administrator views the redirection list.
Remediation: Atomic Edge advises plugin developers to add nonce verification using WordPress’s wp_verify_nonce() function before processing settings updates. Additionally, the plugin must sanitize all incoming text fields with sanitize_text_field(), sanitize_url(), or similar functions before storing them in the database. When displaying redirection rules in the admin interface, the plugin must escape output using esc_url() for URLs and esc_html() for other text to prevent stored XSS.
Impact: Successful exploitation allows attackers to inject arbitrary JavaScript into the WordPress admin panel. This stored XSS can steal administrator session cookies, create new admin users, install malicious plugins, or redirect site traffic to phishing pages. The CSRF component enables the initial injection without direct authentication, lowering the barrier to exploitation. The vulnerability does not provide direct file read or remote code execution, but the combined CSRF to stored XSS chain effectively compromises the entire WordPress installation.
