Technical impact
The CM Registration – Tailored tool for seamless login and invitation-based registrations accepts a 'redirect_url' parameter without proper validation, allowing an unauthenticated attacker to lure users to malicious sites. This flaw, classified as CWE-601, can be used for phishing or social engineering campaigns – inferred based on the typical exploitation pattern of open redirects, as the description does not explicitly state phishing but such use is a common consequence of this weakness.
Affected Systems
The vulnerability affects all installations of the Creative Minds Solutions CM Registration plugin version 2.5.6 and earlier. Any WordPress site running the plugin in these versions is susceptible.
Risk and Exploitability
With a CVSS score of 4.7, the risk profile is moderate, and the EPSS score of less than 1% indicates a low likelihood of exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog. Attackers can trigger the redirect by placing a crafted 'redirect_url' in a link or form, enabling them to direct unsuspecting users to phishing domains or other malicious content.
