The vulnerability arises from insufficient validation of destination URLs in the plugin, allowing attackers to craft links that redirect users to malicious sites. This flaw can be exploited to launch phishing campaigns by embedding deceptive URLs within emails or site content, leading to credential theft or malware deployment. The weakness is a classic Open Redirect (CWE‑601).

WordPress sites running the Aman FunnelKit Automations plugin, version 3.6.0 or earlier.

The CVSS score of 4.7 indicates moderate overall risk, but the low EPSS score (<1%) suggests exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves sending or inserting a crafted link that the plugin will redirect to a target domain without proper validation. An attacker would need to persuade a user to click the link, but the redirect itself does not require elevated privileges on the target site.