The reported vulnerability is a basic open‑redirection flaw in the WordPress plugin that allows attackers to direct users to malicious URLs. By manipulating the redirect URL parameter, a malicious actor can entice a site visitor to click on a link that takes them to a phishing or malware site. This can lead to credential theft, credential stuffing, or other indirect compromise attacks, but does not directly compromise the plugin or the site itself.

The flaw exists in WPFactory’s Scheduled & Automatic Order Status Controller for WooCommerce (order‑status‑rules‑for‑woocommerce) and affects all releases up through version 3.7.1. Any site running that plugin version is susceptible.

The assigned CVSS score of 4.7 places the issue in the medium range, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Although the weakness is simple, an attacker can promote phishing campaigns by crafting links that appear to originate from the legitimate WooCommerce site.