LearnDash Course Redirects CVE-2025-10376

Exploitation requires an active authenticated WordPress administrator session: the attacker must trick a logged-in admin into clicking a malicious link or loading an attacker-controlled page while their session is valid (UI:R). The specific prerequisite is that the plugin's settings-page form processing performs no nonce validation, so any cross-origin POST is accepted. Limiting factors that reduce real-world risk: the required user interaction, the need for the victim to hold administrative privileges and be currently authenticated, and that impact is confined to modifying this plugin's redirect settings (integrity-only, no data disclosure or denial of service). The plugin must be installed and active on the target site.

This is a genuinely low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3 Medium) is internally consistent with a classic CSRF: network reachable and low complexity, but it requires user interaction (UI:R) and yields only limited integrity impact (I:L) with no confidentiality or availability impact. The 'unauthenticated' classification (PR:N) is a CSRF convention - the attacker never authenticates, but the forged request executes in the browser session of an already-authenticated administrator, so a logged-in admin must be socially engineered into clicking. EPSS is 0.13% (2nd percentile), aligning with the absence of any KEV listing and no public POC, all pointing to negligible real-world exploitation pressure. There are no conflicting signals here: every source (low CVSS impact, very low EPSS, no KEV, no POC) agrees this is a low-risk, interaction-dependent settings-tampering flaw rather than an actively exploited priority. The main residual uncertainty is the real functional impact of modifying this plugin's redirect settings, which is not detailed in the advisory.

An attacker crafts a malicious web page or email link containing a forged settings-change request for the Course Redirects for Learndash plugin and lures a logged-in site administrator into visiting it. Because the settings form lacks nonce validation, the administrator's browser silently submits the attacker-controlled values, altering the plugin's redirect configuration. No public exploit code has been identified at time of analysis, and success depends entirely on tricking an authenticated admin into clicking.