WordPress Plugin Vulnerabilities
Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter
Description
The plugin does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.
Proof of Concept
Affects Plugins
Fixed in 1.12.27 References
CVE
Classification
Type
REDIRECT
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Dick Snel
Submitter
Jasper Weijts (Onvio Pentesting)
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-09-30 (about 2 days ago)
Added
2026-09-30 (about 1 day ago)
Last Updated
2026-09-30 (about 1 day ago)
