No Follow All External Links 2.1.0 - 2.3.0 - Backdoor

Hidden Functionality
CVE Not available
CVSS Medium (5.3)
Publicly Published December 28, 2017
Last Updated January 22, 2024
Researcher Wordfence
Description

The No Follow All External Links plugin for WordPress is vulnerable to a backdoor in versions 2.1.0 - 2.3.0. This is due to the criminal actor purchasing the plugin and adding the backdoor themselves. This makes it possible for authenticated attackers to inject content into the vulnerable plugin, commonly used in the past for SEO Spam.

References

1 affected software package

Software Type Plugin
Software Slug nofollow-all-external-links (view on wordpress.org)
Patched? No
Affected Version
  • 2.1.0 - 2.3.0
Patched Version
This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.
License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. License Detail.