CVE-2024-1566 describes a missing authorization (CWE-862) vulnerability in the save function of the Redirects WordPress plugin by mattdeclaire, affecting all versions up to 1.2.1. The lack of capability checks permits unauthenticated users to modify redirect entries, potentially redirecting users to malicious destinations. The vulnerability is network exploitable without privileges or user interaction, impacting integrity and availability with a CVSS 3.1 base score of 6.5.

An attacker can change redirect rules without authentication, potentially redirecting site visitors to phishing or malicious websites. This compromises the integrity of the redirect data and may cause denial of service or user deception. There is no indication of direct confidentiality impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's management interface and monitor for unauthorized changes. Consider disabling the plugin if not essential or applying custom access controls to limit modification capabilities.