CVE-2026-126697 · Package
NO FIX YET · SEE WHAT TO DO
The Quick Page/Post Redirect WordPress plugin before 5.2.4 pulled updates from its author's server instead of WordPress.org, and a tampered 5.2.3 build injected spam content into posts. An attacker who controls that server can inject arbitrary content into pages and deliver arbitrary code to affected sites.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Quick Page/Post Redirect WordPress plugin before 5.2.4, especially tampered 5.2.3 builds delivered from the author's update server between the 5.2.1 and 5.2.4 releases. Sites that never installed this plugin or run 5.2.4 or later are not affected by this update path, and the sources note that sites which ran the tampered build should be treated as potentially compromised.
Not affected if plugin-not-installed, version-5.2.4-or-later
Who cares self-hosted, wordpress, wordpress-plugin
updater/ directory under wp-content/plugins/quick-pagepost-redirect-.../ and for the strings w.anadnet.com or QQQEND in page_post_redirect-....php5.2.4 are affectedanadnet.com or w.anadnet.compage_post_redirect-....php with (tampered 5.2.3)The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that fetched Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 updates from its author's own server instead of WordPress.org, which was used to push a backdoored build to sites, allowing the attacker controlling that server to inject arbitrary content into pages and to deliver arbitrary code to affected sites.
Version 5.2.1, as published on WordPress.org, bundled the Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 Update Checker library (updater/ directory) configured to poll https://anadnet.com/updates/?action=get_metadata&slug=quick-pagepost-redirect-Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4. In March 2021 that server delivered a modified 5.2.3 build, different from the 5.2.3 later published on WordPress.org, which kept the update channel and added a the_content filter that, for logged-out visitors on single posts and pages, fetched content from https://w.anadnet.com/bro/3/ (passing the site host, request URI and visitor User-Agent) and prepended the response to the post (observed serving SEO spam links to search engine crawlers). Because the version string matched a later WordPress.org release, affected sites were not offered a clean update until 5.2.4.
Indicators of compromise:
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
ad717da18cf8a2b69899c0d7dafee05a5.2.4 from WordPress.org, or remove the plugin, as the sources state it has been closed on WordPress.orgRemediation: remove the Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 (it has been closed on WordPress.org), or at minimum reinstall the clean 5.2.4 from WordPress.org, delete any leftover updater/ directory, verify the files with "wp Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 verify-checksums quick-pagepost-redirect-Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4", clear the opcode cache, and treat any site that ran the tampered build as potentially compromised.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.