The vulnerability resides in the Advanced Advertising System WordPress plugin, allowing an attacker to supply the 'redir' parameter without proper validation. This flaw lets unauthenticated users be redirected to arbitrary URLs, potentially leading to phishing or malware delivery. The weakness follows the definition of CWE-601, representing untrusted redirects that enable attackers to manipulate user navigation without permission.

All installable versions of the Advanced Advertising System plugin by smartdevth up to and including 1.3.1 are affected. WordPress sites running these plugin versions are at risk if the 'redir' parameter is exposed in public URLs or internal links.

The CVSS score of 6.1 indicates a moderate severity vulnerability. The EPSS score of less than 1% reflects a low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw by embedding a crafted URL that triggers the redirect parameter, typically through phishing emails or malicious links. Because the redirect target is not validated, users can be sent to dangerous sites without their knowledge.