This vulnerability allows an attacker to manipulate the plugin’s redirect mechanism so that users are sent to an untrusted external site. The weakness is an Open Redirect flaw (CWE‑601) that can be exploited to facilitate phishing or drive users to malicious content. A compromised or unsuspecting user who follows the redirected link may be tricked into revealing credentials or installing malware.

The affected product is the WordPress AS English Admin plugin from Akshar Soft Solutions, applicable to all releases through version 1.0.0. Site owners running this plugin, regardless of WordPress version, are subject to the risk.

The CVSS score of 4.7 indicates a moderate impact. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to click a crafted URL that the plugin processes; therefore the attack vector is web‑based and confined to users interacting with the site. Nonetheless, the damage can be considerable if phishing succeeds.