Safe Redirect Manager CVE-2026-88791

Exploitation requires that the site administrator has already configured a wildcard redirect rule whose destination is an absolute URL - this is a specific, non-default plugin configuration, not the out-of-box state, which is why the vector carries AC:H. Additionally, a victim must actively follow an attacker-crafted request path (UI:R), so exploitation cannot occur without user interaction. No authentication is required of the attacker (PR:N). Impact is limited to redirecting the victim's browser to an arbitrary external site (integrity-only, I:L); there is no direct data disclosure or service disruption. Affected: Safe Redirect Manager before 2.3.0.

This is a genuinely low-priority open redirect (CWE-601). The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N, base 3.4) is internally consistent with the description and its LOW severity is credible: while the attack vector is network and unauthenticated (PR:N), exploitation is throttled by high attack complexity (AC:H - a non-default wildcard-to-absolute-URL redirect rule must already be configured), mandatory user interaction (UI:R - a victim must follow a crafted link), and integrity-only impact (I:L, no confidentiality or availability). CISA SSVC reinforces the low-urgency read: Exploitation=none (no observed activity), Automatable=no, Technical Impact=partial. There is no EPSS score, no CISA KEV listing, and no public exploit code provided - exploitation status is 'no public exploit identified at time of analysis.' All signals align consistently here; there is no CVSS-vs-reality conflict to flag. The one caveat is that open redirects are primarily phishing/social-engineering enablers rather than direct system compromises, so real-world risk is a function of how the site is targeted, not a widespread automated threat.

An attacker identifies a WordPress site running Safe Redirect Manager (<2.3.0) that has configured a wildcard redirect rule pointing to an absolute URL. The attacker crafts a link with a malicious request path that abuses the unvalidated destination and distributes it (e.g., in a phishing email) so that a victim clicking the trusted-looking site link is silently redirected to an attacker-controlled external site to harvest credentials or deliver malware. No public exploit code is provided for this CVE.