Serendipity CVE-2026-67350

Exploitation requires two prerequisites beyond attacker control: (1) the target Serendipity installation must have the Track Exits plugin installed, and (2) the plugin's commentredirection option must be explicitly set to "s9y" - this is not a default configuration and represents a deliberate administrator choice. The CVSS 4.0 AT:P metric confirms this specific attack requirement. Additionally, a human victim must actively click the crafted URL (UI:A), so purely automated or server-side exploitation is not possible. Exploitation is not limited by authentication on the attacker side (PR:N - the attacker is unauthenticated), but the click-required condition and non-default plugin setting together substantially reduce realistic exposure compared to a straightforward network-accessible flaw.

Real-world risk is low-to-moderate and highly scoped. The CVSS 4.0 score of 2.1 is driven by AT:P (attack requires the non-default Track Exits plugin configuration with commentredirection=s9y), UI:A (a victim must actively click the crafted link), and VI:L with no confidentiality or availability impact. No EPSS score, KEV listing, or POC code was provided in the available intelligence, so exploitation status is no public exploit identified at time of analysis. The CVSS 4.0 AT:P metric correctly captures that exploitation is gated on a specific, deliberate plugin configuration - sites not running the Track Exits plugin or using a different commentredirection value are not exposed. Despite the low numeric score, the practical phishing risk is non-trivial: the attack allows abuse of a trusted blog domain to bypass corporate email gateways, proxy reputation filters, and user wariness, enabling targeted social-engineering campaigns. The limited deployment footprint of Serendipity further constrains aggregate exposure.

An attacker identifies a Serendipity blog with the Track Exits plugin active and commentredirection=s9y, then constructs a URL such as https://trustedblog.example.com/exit.php?url=BASE64(https://attacker.com/credential-harvest) and distributes it in a phishing email or social-media post. The victim sees a URL rooted in the familiar, trusted blog domain, clicks it, and is silently forwarded to the attacker's site without browser warnings. No public proof-of-concept code was identified in the available data, but the attack requires only knowledge of Base64 encoding and confirmation of the plugin configuration.