Description

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-13T06:16:25.060Z",
  "pubdate": "2026-09-13T06:16:25.060Z",
  "executiveSummary": "The User Registration & Membership WordPress plugin, in versions prior to 5.2.8, contains a critical Open Redirect vulnerability.\nThe vulnerability exists due to improper input validation on the post-login redirection parameter, which fails to restrict the destination URL to the local domain.\nThis flaw allows unauthenticated remote attackers to craft malicious links that redirect unsuspecting users to arbitrary external websites.\nThe primary risk implications involve sophisticated phishing campaigns, as attackers can leverage the trusted domain of the legitimate website to lend credibility to malicious landing pages.\nSuccessful exploitation does not require administrative privileges or complex authentication states, making it a low-barrier vector for social engineering.\nAdministrators are urged to upgrade to version 5.2.8 or later to mitigate this security risk.",
  "technicalDetails": "The vulnerability is classified as an Open Redirect, stemming from the application's failure to sanitize or validate the 'redirect_to' parameter (or equivalent) used during the authentication workflow.\nIn the vulnerable component, the application accepts a user-supplied URL as a parameter during the login process. The server-side logic processes this parameter and issues an HTTP 302 'Found' response to the browser, directing the user to the provided location upon successful authentication.\nThe root cause is the absence of an allow-list or a regex-based validation check that ensures the destination URL belongs to the host origin. Because the application logic treats any provided string as a valid destination, it facilitates the 'Open Redirect' condition.\nThe attack flow begins when an attacker identifies a target site utilizing the User Registration & Membership plugin. The attacker constructs a crafted URL that includes the plugin's login or registration endpoint combined with a malicious 'redirect_to' parameter pointing to a domain under the attacker's control (e.g., a credential-harvesting site).\nWhen an unauthenticated victim interacts with this link, they are prompted for credentials. Upon submission, the plugin processes the redirection logic. The application fails to verify the absolute URL, allowing the browser to follow the malicious 'Location' header provided in the server response.\nPost-exploitation, the impact is primarily centered on social engineering. By utilizing a legitimate domain's redirect functionality, attackers bypass traditional anti-phishing filters and increase the likelihood that a user will trust the malicious destination. This can lead to credential theft, session hijacking, or the delivery of drive-by malware payloads.\nThe vulnerability affects versions prior to 5.2.8 and does not require elevated privileges to initiate, as the redirection logic is typically exposed on public-facing registration or login pages. The vector is entirely remote and requires no interaction from site administrators to weaponize."
}