The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress allows a directed redirect through the redirect_to parameter without validating its target. An attacker can supply an arbitrary URL, causing users who visit the site and click a manipulated link or submit a form to be forwarded to a malicious domain. This flaw can be used for phishing, credential harvesting, and to deliver further malicious content. The weakness is classified as CWE-601.

All WordPress sites that have the WPO365 | MICROSOFT 365 GRAPH MAILER plugin installed, activated, and using the redirect_to functionality in any version up to and including 3.2 are affected. Sites that have upgraded beyond 3.2, disabled the plugin, or turned off redirect handling are not impacted.

The base CVSS score of 4.7 indicates moderate severity, reflecting the need for user interaction and for the plugin to be active. The EPSS score of less than 1% suggests exploitation is unlikely to be widespread. The vulnerability is not yet listed in CISA KEV, implying low current exploitation. Based on the description, the likely attack vector is an attacker crafting a link or form that includes a malicious redirect_to URL; when a visitor clicks or submits, they are redirected to an attacker-controlled site. This requires unauthenticated access to the site but no special privileges. The overall risk to a site depends on how critical the redirect functionality is to its normal operation.