WuzhiCMS EUVD-2026-83814

Exploitation requires the victim to click an attacker-crafted link to the WuzhiCMS member login endpoint (/index.php?m=member&v=Login) with a manipulated forward parameter - this is the UI:P/user-interaction requirement and the primary limiting factor. No authentication is needed (PR:N) and it works remotely against default configurations of WuzhiCMS up to 4.1.0, since the only sanitization in place, remove_xss(), scrubs XSS keywords/entities but performs no URL/host allowlisting. The impact is limited to redirecting users to arbitrary external destinations (integrity-only); there is no code execution, data disclosure, or availability loss.

This is a genuinely low-priority issue despite a moderate-looking CVSS 4.0 score of 5.3. The vulnerability is an open redirect (CWE-601) in the WuzhiCMS member login flow where the forward parameter is only passed through remove_xss() - an XSS keyword/entity scrubber that does not validate URL destinations, so it fails to stop redirection to arbitrary external hosts. The vendor vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N is internally consistent: network-reachable and unauthenticated (PR:N), but requiring victim interaction (UI:P) and yielding only limited integrity impact (VI:L) with zero confidentiality or availability impact - hallmarks of an open redirect used mainly to lend legitimacy to phishing links. Exploitation signals: POC/exploit code is publicly available (E:P in the vector and a published advisory), but there is no EPSS score provided, no CISA KEV listing, and no evidence of active exploitation - publicly available exploit code exists but must not be conflated with in-the-wild use. SSVC-style reading: exploitation is 'poc', technical impact is 'partial' at best, and while the delivery is technically automatable, an open redirect has no direct system compromise value. Net: a real but minor weakness, best treated as a low-severity hygiene fix rather than an emergency.

An attacker crafts a URL to the WuzhiCMS login endpoint (/index.php?m=member&v=Login) with a malicious forward value pointing to an attacker-controlled site, then delivers it via phishing email or a malicious link so the trusted CMS domain appears in the URL. When the victim clicks and completes or bypasses login, the application redirects them to the attacker's page for credential harvesting or malware delivery. A public exploit/advisory (ArrestX VULN-021) already documents the technique.