What the vulnerability does
01Description
A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability is the function admin_screen_logic of the file wooframework-tweaks.php. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is 3b57d405149c1a59d1119da6e0bb8212732c9c88. It is recommended to upgrade the affected component. The identifier VDB-230653 was assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The WooFramework Tweaks Plugin contains an open redirect vulnerability that allows an attacker to redirect users to external websites. An authenticated user must click a malicious link containing a crafted URL parameter. This can be used to phish credentials or distribute malware by making the redirect appear to come from a trusted site.
What an attacker can do
03Attacker Capabilities
Redirect site users to external websites via a crafted link.
Potential impact on your site
04Site Impact
Users may be redirected to phishing or malware sites, damaging site reputation and user trust.
Conditions required to exploit
05Prerequisites
Attacker needs a valid user account; victim must click the malicious link.
Key dates
06Disclosure timeline
June 5, 2023
CVE published
August 6, 2024
Record updated
