CVE-2026-49067 yydevelopment CVE debrief

Who should care

System administrators, security teams, and WordPress users who have installed the Advanced 301 and 302 Redirect plugin should assess their exposure and take necessary actions to mitigate this vulnerability.

Why it matters

CVE-2026-49067 is a critical unauthenticated SQL injection vulnerability in the Advanced 301 and 302 Redirect WordPress plugin. System administrators and security teams should assess their exposure and take necessary actions to mitigate this vulnerability, as it can lead to potential data breaches or disruption of website functionality.

• Potential data breaches due to malicious SQL injection
• Possible disruption of website functionality
• Increased risk of unauthorized access to sensitive data
• Need for urgent patching and verification of vulnerability status

Technical summary

The Advanced 301 and 302 Redirect WordPress plugin versions up to 1.6.9 contain an unauthenticated SQL injection vulnerability. This vulnerability is tracked as CVE-2026-49067 and has a CVSS score of 9.3. The vulnerability allows attackers to inject malicious SQL code, potentially leading to data breaches or other security issues.

Defensive priority

High priority for patching and verifying vulnerability status

Recommended defensive actions

• Patch the Advanced 301 and 302 Redirect WordPress plugin to version 1.6.10 or later
• Verify vulnerability status for affected systems
• Monitor for potential SQL injection attacks

Evidence notes

The vulnerability was reported by [email protected] and is tracked by CWE-89. The CVE record and NVD detail page provide official information on this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.