RafflePress EUVD-2026-91197

Exploitation requires that the site runs the RafflePress 'Giveaways and Contests' plugin at a version before 1.12.27 with an active giveaway, and that the attacker can set or influence the giveaway's parent page URL, which the plugin saves without validating before using it to redirect visitors via confirmation and referral links. The decisive limiting factor is user interaction (CVSS UI:R): a victim must click a giveaway confirmation or referral link for the redirect to fire, so there is no server-side compromise and no impact absent a clicking victim. Impact is confined to redirecting the visitor's browser to an arbitrary external site (phishing/malware staging); the vulnerable WordPress host's confidentiality, integrity and availability are not directly affected.

This is a moderate-severity open redirect (CWE-601) carrying a CVSS 3.1 base score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The signals are internally consistent: network attack vector, low complexity, no privileges required, but user interaction (a victim clicking a crafted link) is mandatory, and scope is changed because the impact lands on the redirected victim rather than the vulnerable WordPress site itself. No EPSS probability was supplied in the input, there is no CISA KEV listing, and no public exploit code was identified - so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is therefore a real but second-tier priority: open redirects are rarely mass-exploited on their own and are most valuable as a credibility-lending component of phishing/credential-harvesting campaigns. The required user interaction and the limited (low) confidentiality/integrity impact meaningfully cap real-world severity below what the 'network/unauthenticated' portion of the vector might suggest. Patch availability from the vendor makes remediation straightforward, which should raise its practical priority for sites running the affected plugin.

An unauthenticated attacker crafts a giveaway whose parent page URL (or otherwise manipulates the unvalidated URL) points to an attacker-controlled site, so that the plugin's own giveaway confirmation and referral links redirect visitors off-site. A victim clicks what appears to be a trustworthy link on the legitimate WordPress site and is silently sent to a phishing or malware page. No public exploit code was identified at time of analysis, and success depends on the victim clicking the link (UI:R).