CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Explanation of Vulnerability in Simple Terms
WPMobile.App versions 11.56 and earlier contain an open redirect vulnerability. An attacker can craft a malicious URL that redirects users to an external website when clicked. The vulnerability requires no authentication and affects the application's scope, potentially impacting user trust and enabling phishing attacks.
What an attacker can do
Redirect users to a malicious external website via a crafted URL.
Potential impact on your site
Users may be redirected to phishing or malware sites, damaging trust and potentially exposing credentials.
Conditions required to exploit
User must click a malicious link; no authentication required.
Key dates
External resources
Related vulnerabilities
