CVE-2015-9323: WordPress 404-to-301 plugin SQL injection before 2.0.3

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, a public exploit reference, and a very high EPSS percentile make this an urgent patch.

What it is

The 404-to-301 WordPress plugin before version 2.0.3 contains a SQL injection flaw (CWE-89). The plugin handles 404 redirects, so the vulnerable query is reachable through normal site traffic, and successful injection can expose or alter the WordPress database.

Impact

An unauthenticated attacker can read, modify, or delete data in the WordPress database, including user credentials and site content, and may be able to escalate to full site compromise.

Attack surface

Reached over the network via HTTP requests to the WordPress site running the vulnerable plugin; the CVSS vector shows no privileges and no user interaction required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.46125 (98.8th percentile) and public exploit code is referenced, indicating meaningful real-world exploitation likelihood.

What to do

• Update the 404-to-301 plugin to version 2.0.3 or later immediately.
• If patching is not possible, deactivate or remove the plugin until it can be updated.
• Audit the WordPress database and user accounts for signs of tampering after any exposure window.
• Restrict database account privileges used by WordPress to the minimum required.
• Add WAF rules to block SQL injection patterns targeting the plugin's request parameters.

Detection

• Review web server and WAF logs for SQL injection payloads in requests to the 404-to-301 plugin endpoints.
• Monitor database logs for anomalous queries or errors originating from the WordPress application.
• Check for unexpected changes to WordPress users, options, or content that could indicate post-exploitation.
• Search for the public exploit code referenced in advisories and compare its request patterns against traffic logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.