The vulnerability is an open redirect flaw in the KaizenCoders Update URLs WordPress plugin. The plugin performs a search‑and‑replace operation on URLs, but an attacker can supply an arbitrary external address that the plugin will redirect to. Consequently, visitors can be sent to malicious sites under the guise of a legitimate link, enabling phishing attacks and other social‑engineering exploits. The weakness is classified as CWE‑601 (Open Redirect).

Any WordPress site that has the KaizenCoders Update URLs plugin installed and enabled and is running version 1.4.1 or earlier is affected. The flaw resides entirely in the plugin; no specific WordPress core versions are singled out apart from the normal compatibility requirements of the plugin.

The CVSS score of 4.7 indicates a medium severity, while the EPSS score of less than 1% suggests a relatively low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Remote exploitation is straightforward: an attacker can craft a URL that triggers the plugin’s redirect logic, and when an end‑user clicks that link, they are sent to the attacker‑chosen destination. No local privileges or complex conditions are required, making the attack path simple and purely remote.