Security
Loading…

CVE-2026-88791

LOWCVSS 3.4
View on NVD← Back to search
Description

The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.

Timeline
Published:September 30th, 2026 6:17 AM
Last modified:September 30th, 2026 4:28 PM
CVSS Scoring

CVSS v3: 3.4 (LOW)

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N

Weaknesses (CWE)
CWE-601
References & Reports
Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute