CVE-2025-5983
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-10-22
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | meta_tag_manager | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-5983 is a vulnerability in the Meta Tag Manager WordPress plugin versions before 3.3. It occurs because the plugin does not restrict which user roles can create HTTP-equiv refresh meta tags. This means that users with Contributor privileges can add meta tags that cause the browser to automatically redirect to arbitrary URLs, enabling open redirect and phishing attacks. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing users with Contributor privileges to create HTTP-equiv refresh meta tags that redirect visitors to arbitrary URLs. This can be exploited for open redirect attacks, which can facilitate phishing by redirecting users to malicious websites without their knowledge. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your WordPress site is running the Meta Tag Manager plugin version prior to 3.3 and if users with Contributor roles can add HTTP-equiv refresh meta tags. You can verify the plugin version via the WordPress admin dashboard or by running a command to list installed plugins and their versions, for example: `wp plugin list | grep meta-tag-manager`. Additionally, you can inspect posts created by Contributor users for meta tags with http-equiv="refresh" and content attributes that perform redirects. There is no specific network command provided, but reviewing posts or database entries for such meta tags can help detect exploitation. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Meta Tag Manager WordPress plugin to version 3.3 or later, where this vulnerability is fixed. Additionally, restrict Contributor user roles from adding or editing meta tags if possible, and review existing posts for malicious HTTP-equiv refresh meta tags to remove them. [1]