CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
The Advanced Advertising System plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.3.1. This is due to insufficient validation on the redirect url supplied via the 'redir' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Explanation of Vulnerability in Simple Terms
The Advanced Advertising System contains an open redirect vulnerability that allows attackers to redirect users to arbitrary external websites. An attacker can craft a malicious link within the application that, when clicked by a user, sends them to a third-party site. This can be used for phishing attacks or credential theft. All versions up to 1.3.1 are affected.
What an attacker can do
Redirect users to malicious external websites via crafted links in the advertising system.
Potential impact on your site
Users can be redirected away from your site to phishing or malware sites, damaging trust and potentially exposing credentials.
Conditions required to exploit
A user must click a malicious link crafted by the attacker within the application.
Key dates
External resources
Related vulnerabilities
