The Ultimate WP Mail plugin contains an open redirect vulnerability that allows an attacker to craft URLs that direct legitimate site visitors to malicious, untrusted destinations. This flaw, identified as CWE‑601, can facilitate phishing attacks by making users believe they are accessing trusted content while actually exposing them to social engineering or credential theft.

The issue affects the Rustaurius Ultimate WP Mail plugin from its earliest releases up through version 1.3.10. Users running any of these or older versions are exposed to the redirection flaw.

The CVSS score of 4.7 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by embedding malicious redirect parameters in links or through social engineering, making the plug‑in's redirect handling an attractive vector for phishing campaigns.