CVE-2026-7562 is a CSRF vulnerability in the WP-Redirection WordPress plugin (versions up to 1.0.3). The vulnerability exists because the plugin's admin settings form lacks a nonce field, and the function displayWPRedirectionManagementPage() does not verify nonces before handling POST requests that add, edit, or delete redirection rules. This allows an attacker to craft a malicious link that, when clicked by an authenticated administrator, can manipulate the plugin's redirection database entries without authorization.

An attacker can cause a logged-in WordPress administrator to unknowingly create, modify, or delete URL redirection rules in the WP-Redirection plugin. This could lead to unauthorized changes in site redirection behavior, potentially facilitating phishing, traffic hijacking, or other indirect impacts. There is no direct confidentiality or availability impact reported. The CVSS score of 4.3 reflects a medium severity with low complexity and no privileges required but requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links while logged into WordPress and consider restricting access to the plugin's admin pages. Monitoring for updates from the plugin vendor or WordPress plugin repository is recommended to apply any forthcoming patches promptly.