Aculect Ai Companion
Monthly
An open redirect (CWE-601) in the WordPress plugin Aculect AI Companion, affecting all versions through 0.8.1, lets remote attackers craft a link that bounces a victim to an arbitrary external site after they click it. The flaw is reachable over the network without authentication (PR:N) but requires user interaction (UI:R) per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, giving a moderate base score of 4.7 with only low confidentiality impact and no integrity or availability impact. Because exploitation is limited to redirection and phishing rather than data access or code execution, and the plugin has a small deployment footprint, real-world risk is modest; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
An open redirect (CWE-601) in the WordPress plugin Aculect AI Companion, affecting all versions through 0.8.1, lets remote attackers craft a link that bounces a victim to an arbitrary external site after they click it. The flaw is reachable over the network without authentication (PR:N) but requires user interaction (UI:R) per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, giving a moderate base score of 4.7 with only low confidentiality impact and no integrity or availability impact. Because exploitation is limited to redirection and phishing rather than data access or code execution, and the plugin has a small deployment footprint, real-world risk is modest; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.