Executive Summary

The User Registration & Membership plugin for WordPress has an Open Redirect vulnerability in versions up to and including 5.1.4. This occurs because the plugin does not properly validate user-supplied URLs passed via the 'redirect_to_on_logout' GET parameter before redirecting users. Instead of using a domain-restricted redirect function, it uses WordPress's wp_redirect() function directly, which allows attackers to craft links that redirect users to potentially malicious external websites after logout.

Although the plugin applies esc_url_raw() to sanitize malformed URLs, this function does not restrict redirects to the local domain, enabling the open redirect issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by attackers to redirect users to malicious external websites after they log out. Such redirects can facilitate phishing attacks by tricking users into visiting harmful sites that may steal credentials or distribute malware.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to redirect users to potentially malicious external URLs after logout, which could facilitate phishing attacks.

Such phishing risks may lead to unauthorized disclosure or misuse of personal data, potentially impacting compliance with data protection regulations like GDPR and HIPAA that require safeguarding user data and preventing unauthorized access or redirection.

However, the provided information does not explicitly state the direct impact on compliance with these standards.

Useful 0 Not Useful 0