WordPress Redirect Plugin – Hidden Backdoor Discovered
Scope: WordPress (Affected Redirect Plugin)
Severity: Red
A widely used WordPress redirect plugin was found to contain a long-dormant hidden backdoor enabling unauthorized administrative access under specific conditions. Exploitation allows attackers to execute arbitrary code, redirect or modify website content, inject malware, and exfiltrate sensitive user data. Site owners should remove or update the affected plugin immediately, audit for unauthorized users and files, and rotate all administrative credentials.
The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.