EUVD-2026-22135
GHSA-2vmw-qjp2-rr96
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-exploitable with no privileges; UI:R because victim must click crafted link; S:C reflects cross-domain redirect; C:L/I:L captures phishing facilitation; A:N as no availability impact exists.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5.1.4. This is due to insufficient validation of user-supplied URLs passed via the 'redirect_to_on_logout' GET parameter before redirecting users. The redirect_to_on_logout GET parameter is passed directly to WordPress's wp_redirect() function instead of the domain-restricted wp_safe_redirect(). While esc_url_raw() is applied to sanitize malformed URLs, it does not restrict the redirect destination to the local domain, allowing an attacker to craft a specially formed link that redirects users to potentially malicious external URLs after logout, which could be used to facilitate phishing attacks.
AnalysisAI
Open redirect in the WPEverest User Registration & Membership WordPress plugin (versions ≤5.1.4) enables attackers to abuse the logout flow as a phishing vector by supplying an arbitrary external URL via the redirect_to_on_logout GET parameter. The plugin passes this parameter directly to WordPress's unrestricted wp_redirect() instead of the domain-enforcing wp_safe_redirect(), and the esc_url_raw() sanitization applied only strips malformed URL syntax - it imposes no domain allowlist. A publicly available POC demonstrates the redirect behavior; however, EPSS is very low (0.03%, 7th percentile) and CISA SSVC rates exploitation as 'none' with non-automatable impact, indicating no observed mass exploitation at time of analysis.
Technical ContextAI
This is a CWE-601 (URL Redirection to Untrusted Site) flaw rooted in WordPress's dual redirect API: wp_safe_redirect() validates the destination against an allowlist of permitted hosts (defaulting to the local site), while wp_redirect() performs no domain restriction. The plugin's includes/functions-ur-template.php (line 39, confirmed in both the tagged 5.1.4 source and the trunk branch via Trac references) calls wp_redirect() with the redirect_to_on_logout GET parameter after applying only esc_url_raw(), which is designed to produce a safe URL string for database or header use - not to enforce same-origin constraints. A well-formed HTTPS URL to an attacker-controlled domain therefore passes through unmodified. The affected CPE is cpe:2.3:a:wpeverest:user_registration_&_membership_... covering all versions from 0 through 5.1.4, as confirmed by NVD and EUVD (EUVD-2026-22135).
RemediationAI
The definitive fix requires updating the User Registration & Membership plugin to a version beyond 5.1.4 once WPEverest releases a patched build - no specific patched version number has been confirmed in available data at time of analysis. The upstream code change needed is replacing the wp_redirect() call with wp_safe_redirect() in includes/functions-ur-template.php line 39; security teams can verify the fix is present by inspecting this file in any candidate update. If immediate upgrade is not possible, administrators can implement a WAF rule to strip or reject requests containing external hostnames in the redirect_to_on_logout parameter - this has no impact on normal logout flows since the parameter is only meaningful for post-logout redirection. The Wordfence security plugin (free tier) may also provide a virtual patch for this specific parameter. Disabling the logout redirect feature entirely via plugin settings, if the option exists, eliminates the attack surface with no functional impact for most deployments.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today