WordPress Plugin Vulnerabilities

Ultimate WP Mail <= 1.3.9 - Open Redirect

Description

The plugin is vulnerable to Open Redirect due to insufficient validation on a redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

Affects Plugins

Plugin icon
ultimate-wp-mail
No known fix

References

CVE
CVE-2025-32694
URL
https://patchstack.com/database/wordpress/plugin/ultimate-wp-mail/vulnerability/wordpress-ultimate-wp-mail-1-3-2-open-redirection-vulnerability

Classification

Type
REDIRECT
OWASP top 10
A1: Injection
CWE
CWE-601
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Le Ngoc Anh
Verified
No
WPVDB ID
aab7d9de-cce4-484e-aa75-9bd2c732462b

Timeline

Publicly Published
2025-04-09 (about 1 year ago)
Added
2025-04-16 (about 1 year ago)
Last Updated
2025-10-07 (about 9 months ago)

Other

Published
Title
Published
2015-03-30
Title
Newsletter 3.7.0 - Open Redirect
Published
2014-05-07
Title
Prostore < 1.1.3 - Open Redirection
Published
2024-05-23
Title
Themify Builder < 7.5.8 - Open Redirect
Published
2025-01-24
Title
KB Support < 1.6.8 - Unauthenticated Open Redirect
Published
2024-04-12
Title
Freshdesk (official) < 2.4.0 - Open Redirect