Redirection Security & Risk Analysis
wordpress.org/plugins/redirect-redirectionRedirection
Is Redirection Safe to Use in 2026?
Generally Safe
Score 99/100Redirection has a strong security track record. Known vulnerabilities have been patched promptly.
The "redirect-redirection" plugin v1.2.9 presents a mixed security posture. While it demonstrates good practices like a high percentage of prepared SQL statements and a significant number of nonce and capability checks, several concerning aspects emerge from the static analysis. The presence of one AJAX handler without authentication checks is a direct entry point for potential unauthorized actions, even if no critical taint flows were identified. The high number of total AJAX handlers (28) further amplifies this concern, as a single oversight can lead to vulnerabilities.
The plugin's vulnerability history is a significant red flag. With 27 known medium-severity CVEs, even though none are currently unpatched, it indicates a recurring pattern of security weaknesses, particularly in CSRF and missing authorization. This suggests that while past vulnerabilities may have been addressed, the underlying codebase might still be susceptible to similar issues. The fact that all past CVEs were medium severity might imply that while not critical, they were significant enough to warrant patching and represent a history of less than ideal security implementation.
In conclusion, while the plugin has some strengths in its use of prepared statements and checks, the unprotected AJAX handler, coupled with a history of numerous medium-severity vulnerabilities, points to a moderate overall security risk. Diligent review and potentially refactoring of authentication mechanisms for all entry points would be beneficial to improve its security.
Key Concerns
- AJAX handler without auth checks
- High number of medium CVEs historically
- Low percentage of properly escaped output
- Use of unserialize function
Redirection Security Vulnerabilities
CVEs by Year
Severity Breakdown
27 total CVEs
Redirection <= 1.1.4 - Cross-Site Request Forgery to Plugin Reset
Redirect Redirection <= 1.1.4 - Cross-Site Request Forgery to Plugin De-Installation
Redirect Redirection <= 1.1.3 - Missing Authorization in 'LoadTab' function
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'addRedirect' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'redirectionPageContent' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'addRedirect' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'deleteRedirect' function
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'SaveSettings' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'SaveSettings' function
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'bulkDelete' function
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'statusBulkEdit' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'instantEditRedirect' function
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'addRedirectRule' function
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'saveRedirectSettings' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'loadRedirectSettings' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'liveSearch' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'loadSettings' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'addRedirectRule' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'logFilter' function
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'deleteRedirect' function
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'cronLogDeleteOption' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'logPageContent' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'selectAll' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'bulkDelete' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'statusBulkEdit' function
Redirect Redirection <= 1.1.3 - Missing Authorization in 'saveRedirectSettings' function
Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'instantEditRedirect' function
Redirection Code Analysis
Dangerous Functions Found
SQL Query Safety
Output Escaping
Data Flow Analysis
Redirection Attack Surface
AJAX Handlers 28
WordPress Hooks 34
Maintenance & Trust
Redirection Maintenance & Trust
Maintenance Signals
Community Trust
Redirection Alternatives
301 Redirects – Redirect Manager
eps-301-redirects
Manage 301 & 302 redirects. Simple redirection & redirects validation. Includes redirect stats & 404 error log.
Redirect.txt
redirect-txt
Manage 301 & 302 redirects easily. No posts creation bloat, just a simple list.
Simple 301 Redirects By BetterLinks – Easy WordPress Redirect Manager for Redirects, 404 Error Log & More
simple-301-redirects
Simple 301 Redirects provides an easy method of redirecting requests to another page on your site or elsewhere on the web.
301 Redirects & 404 Error Log
301-redirects
Create & manage 301 redirects. Easily test redirects. Includes 404 error log.
SEO Redirection Plugin – 301 Redirect Manager
seo-redirection
SEO Redirection is a powerful redirect manager to manage 301 redirects without requiring knowledge of Apache .htaccess files.
Redirection Developer Profile
6 plugins · 620K total installs
How We Detect Redirection
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/redirect-redirection/assets/js/admin.js/wp-content/plugins/redirect-redirection/assets/js/scripts.js/wp-content/plugins/redirect-redirection/assets/css/style.css/wp-content/plugins/redirect-redirection/assets/css/admin.css/wp-content/plugins/redirect-redirection/assets/js/admin.js/wp-content/plugins/redirect-redirection/assets/js/scripts.jsredirect-redirection/assets/js/admin.js?ver=redirect-redirection/assets/js/scripts.js?ver=redirect-redirection/assets/css/style.css?ver=redirect-redirection/assets/css/admin.css?ver=HTML / DOM Fingerprints
irrp-containerirrp-section-titleirrp-redirect-formirrp-settings-formirrp-log-table<!-- Plugin's constants --><!-- Create tables on activation. --><!-- Disable CRON job on deactivation --><!-- Load the plugin -->+6 moredata-irrp-actiondata-irrp-redirect-iddata-irrp-rule-iddata-irrp-log-idirrp_params/wp-json/redirect-redirection/v1/settings/wp-json/redirect-redirection/v1/redirects/wp-json/redirect-redirection/v1/logs