CM Registration CVE-2025-11167

Exploitation requires the attacker to supply a malicious value to the 'redirect_url' parameter on the plugin's login/invitation-based registration flow (LoginController), which performs insufficient validation on the redirect target. The key limiting factor is mandatory user interaction (UI:R): a victim must be socially engineered into clicking the attacker-crafted link, so this cannot be exploited silently or at scale without a phishing lure. No authentication is required (PR:N). The flaw affects the plugin as installed (no non-default configuration is indicated in the description), but impact is confined to redirecting the victim's browser - there is no server-side code execution, data disclosure, or availability impact.

This is a genuinely low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) scores 4.7 (Medium) and confirms unauthenticated, low-complexity network exploitation - but critically requires user interaction (UI:R) and yields only limited integrity impact (I:L) with no confidentiality or availability loss, consistent with an Open Redirect (CWE-601). EPSS reinforces low real-world risk at 0.21% (11th percentile), indicating very low predicted exploitation probability. There is no CISA KEV listing and no public exploit code identified in the provided data, so this is not under active exploitation. No SSVC decision data was provided. Signals are consistent rather than conflicting: a low-severity, interaction-dependent redirect flaw in a niche WordPress plugin with low EPSS and no KEV/POC. The scope change (S:C) that pushes the score up reflects impact on the redirected user's browser/trust context rather than a compromise of the server itself. Realistic priority is low - patch in routine maintenance; this is not an emergency.

An attacker crafts a URL pointing to the vulnerable plugin's login/invitation endpoint with a malicious 'redirect_url' parameter and distributes it via phishing email or a malicious post. When a victim clicks the trusted-looking link (bearing the legitimate site's domain), the plugin redirects them to an attacker-controlled site for credential harvesting or malware delivery. No public exploit code was identified, but the technique is trivial and the required user interaction is the only meaningful barrier.