The vulnerability is an open redirection flaw that allows a malicious party to forge a URL which, when visited through the affected plugin, leads a user to a malicious or phishing site. This type of flaw can be leveraged for credential harvesting or delivering deceptive content, but it does not grant code execution or direct system compromise. The weakness is classified as CWE‑601 and reflects a lack of strict destination validation before performing a redirect.

The affected product is the WordPress plugin CRM Perks: Integration for WooCommerce and Salesforce, versions from the earliest available through 1.7.5 inclusive. No other vendors or product versions were explicitly indicated.

The CVSS score of 4.7 identifies the exploit as low severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attack entry is inferred to occur when a user interacts with a crafted link or timer on the site that triggers the plugin’s redirect logic, without requiring authentication. Because the flaw is not complex, an attacker may simply embed the link in a phishing email or a malicious advertisement to lure unsuspecting users.