Threats tagged 'ghsa-326x-6v6x-22wv'

The Quick Page/Post Redirect Plugin for WordPress versions before 5.2.4 contained a hidden update mechanism that fetched updates from the author's own server instead of the official WordPress.org repository. This mechanism was exploited to deliver a backdoored plugin build (notably version 5.2.3) that injected arbitrary content into pages and delivered arbitrary code, primarily serving SEO spam to logged-out visitors. The plugin was removed from WordPress.org, and a clean version 5.2.4 was later published to address this issue.