CVE-2026-49067: WordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the WordPress plugin Advanced 301 and 302 Redirect at version 1.6.9 and earlier. The flaw is reachable over the network with no authentication required and no user interaction needed, meaning any remote visitor can send a crafted request directly to the affected endpoint. Successful exploitation reads data from the underlying database and can partially disrupt service availability. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a patch.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the WordPress site to trigger the injection.

• AuthenticationNot required

  No account or session token is needed; the injection can be triggered by any unauthenticated HTTP request.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the server without involving any logged-in user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special timing, or knowledge of environment-specific values.

Blast Radius

• An attacker reads arbitrary rows from the WordPress database, including stored user credentials (hashed passwords), email addresses, session tokens, and any plugin-persisted customer data.
• Because the scope token is Changed (S:C), database reads can extend beyond the plugin's own data to other tables or schemas accessible to the database user, depending on database configuration.
• Service availability is partially degraded; malformed or resource-intensive SQL queries can slow or crash database-dependent page loads, affecting site uptime.