CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
What the vulnerability does
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership After Login Redirection simple-membership-after-login-redirection.This issue affects Simple Membership After Login Redirection: from n/a through <= 1.6.
Explanation of Vulnerability in Simple Terms
The Simple Membership After Login Redirection plugin for WordPress contains an open redirect vulnerability in versions 1.6 and earlier. An attacker can craft a malicious link that redirects authenticated users to an external website after login. The vulnerability requires user interaction—the victim must click the attacker's link—but can be used for phishing or credential harvesting attacks.
What an attacker can do
Redirect logged-in users to a malicious external website via a crafted link.
Potential impact on your site
Users can be redirected to phishing sites or malware after logging in, potentially compromising credentials or devices.
Conditions required to exploit
User must click an attacker-supplied link and complete login.
Key dates
External resources
Related vulnerabilities
