CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.2.24. This is due to insufficient validation on the redirect url supplied via the 'rcp_redirect' parameter. This makes it possible for unauthenticated attackers to redirect users with the password reset email to potentially malicious sites if they can successfully trick them into performing an action.
Explanation of Vulnerability in Simple Terms
The Membership Plugin – Restrict Content for WordPress contains a weakness that allows attackers to modify content through user interaction. An attacker without authentication can craft a malicious link or page that, when visited by a site user, causes unintended changes to site data. The vulnerability affects versions up to 3.2.24. Site administrators should update to a patched version when available.
What an attacker can do
Modify site content or data if a user clicks a malicious link or visits an attacker-controlled page.
Potential impact on your site
Site content or settings could be altered without authorization if users are tricked into clicking malicious links.
Conditions required to exploit
No authentication required. A site user must click a link or visit a page controlled by the attacker.
Key dates
External resources
Related vulnerabilities
