The Directorist plugin for WordPress contains a flaw that allows an attacker to redirect users to a site of the attacker’s choice. This open redirection leads to phishing attacks by convincing users that the link is legitimate. The root cause is a lack of validation of redirect destinations, classified as CWE‑601.

All releases of the wpWax Directorist plugin from the earliest unversioned build through version 8.6.6 are affected. Administrators should verify they are using a version newer than 8.6.6 to avoid exploitation.

The CVSS score of 4.7 indicates moderate severity, while the EPSS score of less than 1 % suggests low to very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is the use of crafted URLs with redirection parameters; the plugin accepts these without checking the target domain, allowing malicious redirects.