What the vulnerability does
01Description
A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown functionality of the file classes/class-icons-for-features-admin.php. The manipulation of the argument redirect_url leads to open redirect. The attack may be launched remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 63124c021ae24b68e56872530df26eb4268ad633. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227756.
Explanation of Vulnerability in Simple Terms
02Summary
The Icons for Features Plugin contains an open redirect vulnerability that allows an attacker to redirect users to an external website. An authenticated user with low privileges must click a malicious link to trigger the redirect. The vulnerability has low integrity impact and does not affect confidentiality or availability.
What an attacker can do
03Attacker Capabilities
Redirect site users to an external website via a crafted link.
Potential impact on your site
04Site Impact
Users could be redirected away from your site to phishing or malware sites if they click attacker-controlled links.
Conditions required to exploit
05Prerequisites
Attacker needs a low-privilege account; victim must click the malicious link.
Key dates
06Disclosure timeline
April 30, 2023
CVE published
November 22, 2024
Record updated
