WordPress Plugin Vulnerabilities

Payflex Payment Gateway < 2.6.2 - Open Redirect

Description

The plugin is vulnerable to Open Redirect due to insufficient validation on a redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

Affects Plugins

Plugin icon
payflex-payment-gateway
Fixed in 2.6.2

References

CVE
CVE-2024-47646
URL
https://patchstack.com/database/vulnerability/payflex-payment-gateway/wordpress-payflex-payment-gateway-plugin-2-6-1-open-redirection-vulnerability

Classification

Type
REDIRECT
OWASP top 10
A1: Injection
CWE
CWE-601
CVSS
4.7 (medium)

Miscellaneous

Original Researcher
ardias
Verified
No
WPVDB ID
93afc8de-c99c-4827-8643-c46acdedcf95

Timeline

Publicly Published
2024-09-30 (about 1 year ago)
Added
2024-10-10 (about 1 year ago)
Last Updated
2024-10-15 (about 1 year ago)

Other

Published
Title
Published
2024-12-05
Title
Login Widget With Shortcode <= 6.1.2 - Open Redirect
Published
2025-04-01
Title
Integration of Zoho CRM and Contact Form 7 <= 1.0.7 - Open Redirect
Published
2017-09-20
Title
WordPress 2.9.2-4.8.1 - Open Redirect
Published
2015-01-29
Title
WPtouch < 3.7 - Unvalidated Open Redirect
Published
2025-08-21
Title
Wp Edit Password Protected < 1.3.5 - Open Redirect