This vulnerability is an open redirect flaw in the Login Redirect plugin of aircheng-org iWebShop‑5. The IController::redirect function accepts a user‑controlled callback parameter, enabling an attacker to supply any URL. When the application follows that callback, users are sent to the attacker’s site. The flaw does not grant code execution but can facilitate phishing, drive‑by downloads, or social‑engineering attacks, potentially compromising user trust and allowing further compromise. The weakness is classified as CWE‑601.

The flaw affects aircheng-org iWebShop‑5 versions up to and including 5.16. The component is distributed under the iWebShop‑5 name.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV database. Exploitation requires only a crafted URL that can be triggered remotely. Publicly available exploit code could be used to redirect users to malicious sites.