The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5.1.4. This is due to insufficient validation of user-supplied URLs passed via the 'redirect_to_on_logout' GET parameter before redirecting users. The `redirect_to_on_logout` GET parameter is passed directly to WordPress's `wp_redirect()` function instead of the domain-restricted `wp_safe_redirect()`. While `esc_url_raw()` is applied to sanitize malformed URLs, it does not restrict the redirect destination to the local domain, allowing an attacker to craft a specially formed link that redirects users to potentially malicious external URLs after logout, which could be used to facilitate phishing attacks.
The User Registration & Membership WordPress plugin versions up to 5.1.4 contain an open redirect vulnerability in the logout redirect parameter that allows attackers to redirect users to malicious external sites. This vulnerability could be exploited for phishing attacks by crafting specially formed links that bypass URL validation.
تحتوي إضافة User Registration & Membership لـ WordPress على ثغرة إعادة توجيه مفتوحة في معامل redirect_to_on_logout الذي يسمح للمهاجمين بتحويل المستخدمين إلى مواقع خارجية ضارة. يمكن استغلال هذه الثغرة لشن هجمات التصيد الاحتيالي من خلال روابط مصممة خصيصاً تتجاوز التحقق من صحة عناوين URL.
The User Registration & Membership WordPress plugin versions up to 5.1.4 contain an open redirect vulnerability in the logout redirect parameter that allows attackers to redirect users to malicious external sites. This vulnerability could be exploited for phishing attacks by crafting specially formed links that bypass URL validation.
Update the User Registration & Membership plugin to version 5.1.5 or later immediately. Replace all instances of wp_redirect() with wp_safe_redirect() for the redirect_to_on_logout parameter to enforce domain-restricted redirects. Implement additional server-side validation to whitelist allowed redirect destinations.
قم بتحديث إضافة تسجيل المستخدمين والعضويات إلى الإصدار 5.1.5 أو أحدث فوراً. استبدل جميع استدعاءات wp_redirect() بـ wp_safe_redirect() لمعامل redirect_to_on_logout لفرض إعادة توجيه مقيدة بالنطاق. طبق التحقق الإضافي من جانب الخادم لإدراج وجهات إعادة التوجيه المسموحة في قائمة بيضاء.