CVE-2026-126697: Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel
The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that fetched Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 updates from its author's own server instead of WordPress.org, which was used to push a backdoored build to sites, allowing the attacker controlling that server to inject arbitrary content into pages and to deliver arbitrary code to affected sites.
Version 5.2.1, as published on WordPress.org, bundled the Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 Update Checker library (updater/ directory) configured to poll https://anadnet.com/updates/?action=getmetadata&slug=quick-pagepost-redirect-Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4. In March 2021 that server delivered a modified 5.2.3 build, different from the 5.2.3 later published on WordPress.org, which kept the update channel and added a thecontent filter that, for logged-out visitors on single posts and pages, fetched content from https://w.anadnet.com/bro/3/ (passing the site host, request URI and visitor User-Agent) and prepended the response to the post (observed serving SEO spam links to search engine crawlers). Because the version string matched a later WordPress.org release, affected sites were not offered a clean update until 5.2.4.
Indicators of compromise: - Outbound requests to anadnet.com or w.anadnet.com - An updater/ directory (Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 Update Checker, Puc v4p10) inside wp-content/Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4/quick-pagepost-redirect-Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4/ - The strings filterthecontentinthemainloop, pprpro, QQQEND or w.anadnet.com in pagepostredirectQuick Page/Post Redirect Plugin WordPress plugin before 5.2.4.php - pagepostredirectQuick Page/Post Redirect Plugin WordPress plugin before 5.2.4.php with MD5 ad717da18cf8a2b69899c0d7dafee05a (tampered 5.2.3)
Remediation: remove the Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 (it has been closed on WordPress.org), or at minimum reinstall the clean 5.2.4 from WordPress.org, delete any leftover updater/ directory, verify the files with "wp Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 verify-checksums quick-pagepost-redirect-Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4", clear the opcode cache, and treat any site that ran the tampered build as potentially compromised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Quick Page/Post Redirect Pluginto a version that resolves this vulnerability.Fixed in 5.2.4 - Remove
Remove the affected component from your environment.
Remove the Quick Page/Post Redirect Plugin.
- Remove
Remove the affected component from your environment.
Delete any leftover updater/ directory from the plugin.
- Operational
Verify the plugin files with `wp quick-pagepost-redirect verify-checksums`.
- Operational
Clear the opcode cache.
Event History
Frequently Asked Questions
Which sites were exposed to the malicious content injection behavior?
Sites that received the modified 5.2.3 build were exposed when logged-out visitors viewed single posts or pages. That build fetched remote content from w.anadnet.com and prepended it to post content; observed content included SEO spam links shown to search-engine crawlers.
What did an attacker need to exploit this issue?
The attacker needed control of the plugin author's off-repository update server. That server-controlled update channel could distribute a modified plugin build and deliver arbitrary code to affected sites.
How can I check whether a site received the backdoored build?
Inspect the plugin's updater directory for an update checker configured to poll anadnet.com for Quick Page/Post Redirect updates. Also inspect the plugin code for a the_content filter that requests content from w.anadnet.com/bro/3/ and prepends the response to posts or pages.
What should be done if the affected plugin version is installed?
Upgrade to version 5.2.4 or later, since versions before 5.2.4 used the hidden off-repository update mechanism. If an affected site may have received the modified build, review plugin files and published page content for the remote-content injection behavior.