CVE-2023-51517 MEDIUM

CVE-2023-51517: WordPress Calculated Fields Form Plugin <= 1.2.28 is vulnerable to Open Redirection

Vendor Codepeople
Product Calculated Fields Form
Weakness CWE-601 · Open redirect
Published December 29, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.This issue affects Calculated Fields Form: from n/a through 1.2.28.

Explanation of Vulnerability in Simple Terms

02Summary

Calculated Fields Form versions up to 1.2.28 contain an open redirect vulnerability. An attacker with low-level user access can craft a malicious link that redirects users to an external website after they interact with the form. The redirect happens because user-supplied input is not validated before being used in a redirect operation. This can be used to phish credentials or distribute malware.

What an attacker can do

03Attacker Capabilities

Redirect users to a malicious external website via a crafted form link.

Potential impact on your site

04Site Impact

Users can be tricked into visiting phishing or malware sites, damaging site reputation and user trust.

Conditions required to exploit

05Prerequisites

Attacker needs low-level user account access; victim must click the malicious link.

Key dates

06Disclosure timeline

December 29, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-1296 Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter CVE-2025-14451 Solutions Ad Manager <= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' Parameter CVE-2025-58006 WordPress WP Gravity Forms Keap/Infusionsoft plugin <= 1.2.6 - Open Redirection vulnerability CVE-2025-3433 Advanced Advertising System <= 1.3.1 - Open Redirect CVE-2025-32694 WordPress Ultimate WP Mail plugin <= 1.3.10 - Open Redirection vulnerability