The vulnerability enables an attacker to redirect a user from a trusted WordPress site to an arbitrary URL, facilitating phishing and social‑engineering attacks. The weakness originates from improper validation of URL parameters, classified as CWE‑601, and allows attackers to craft a malicious link that appears to come from a legitimate source. If exploited, the affected user may unknowingly disclose credentials or sensitive information to the attacker after being redirected.

Kings Plugins B2BKing Premium, all installations of the plugin prior to version 5.4.20, regardless of other WordPress components or hosting configurations.

The CVSS score of 4.7 indicates a moderate risk level. Exploitation probability is very low, with an EPSS score below 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path is through a crafted URL presented to a user via email, blog, or infected content on the site, persisting the need for victim interaction but offering a straightforward exploitation method for anyone able to construct and share the malicious link.