CVE-2021-24352: 
WordPress vulnerability analysis and mitigation

The Simple 301 Redirects by BetterLinks WordPress plugin versions 2.0.0 to 2.0.3 contained a critical security vulnerability (CVE-2021-24352) that was discovered and disclosed on May 26, 2021. The vulnerability affected the export_data function of the plugin, which lacked proper capability and nonce checks, making it possible for unauthenticated users to export a site's redirects (WPScan).

The vulnerability was assigned a CVSS score of 9.9 (Critical) and was classified as an Access Controls issue, specifically falling under the OWASP Top 10 category A5: Broken Access Control and CWE-284. The vulnerability could be exploited through a network vector without requiring privileges or user interaction. A proof of concept exploit involved sending a POST request to '[URL]/wp-admin/admin-post.php?page=301options&export=true' (WPScan, Wordfence).

The vulnerability allowed unauthenticated users to export a site's redirects, potentially exposing sensitive information about the website's structure and redirect configurations (WPScan).

The vulnerability was relatively easy to exploit as it required no authentication and could be triggered with a simple HTTP POST request. The exploit could be executed remotely through the network vector (WPScan).

The vulnerability was patched in version 2.0.4 of the Simple 301 Redirects by BetterLinks plugin. Users were advised to update to this version or later to protect their installations (WPScan).

The vulnerability was discovered and reported by security researcher Chloe Chamberland from Wordfence. The discovery was documented and published through various security platforms including WPScan and Wordfence's blog (WPScan).