The WordPress Search & Filter plugin with versions up to 1.2.17 contains a Cross‑Site Request Forgery flaw that can be used to redirect a user to an arbitrary URL. The plugin fails to verify a CSRF token when processing certain requests, allowing an attacker to manipulate the redirect path. This enables the attacker to send users to phishing pages or malicious downloads. The weakness is classified as CWE‑352.

Affected hosts are WordPress sites that have installed the Search & Filter plugin by Code Amp and are running any release with a version number <= 1.2.17. No other versions were impacted at the time of disclosure. The vulnerability can appear on any site that uses the plugin, regardless of the site’s size or user base.

The CVSS score of 4.7 indicates a moderate severity. The EPSS score is reported as < 1%, so the likelihood that this flaw is actively exploited in the wild is low. It is not listed in CISA’s KEV catalog. The likely attack vector is inferred from the description: an attacker needs to supply a malicious link or form that a user will interact with, and no special privileges are required. If a user follows such a link, the victim will be redirected to the attacker‑controlled site.