The User Registration & Membership plugin for WordPress contains an open redirect flaw that allows an unauthenticated attacker to influence the location users are sent to after logging out. By supplying a crafted 'redirect_to_on_logout' query parameter the request bypasses WordPress's safe redirect checks and is processed by wp_redirect(), resulting in a redirection to an arbitrary external site. This weakness corresponds to CWE‑601 and can be exploited to facilitate phishing or drive-by infection attacks when users are tricked into following malicious links.

WordPress websites that use the User Registration & Membership plugin version 5.1.4 or earlier are vulnerable. The plugin provides free and paid membership, subscription, content restriction, user profile, and custom registration & login features. Sites running legacy versions of the plugin are at risk until they are updated.

The vulnerability carries a CVSS score of 6.1. While a precise EPSS score is not available, the flaw is not noted in the CISA KEV catalog. Attackers could exploit it remotely by directing users to a malicious URL after logout; this attack vector is inferred from the description because the flaw arises from an unauthenticated GET request. Successful exploitation would give an attacker the ability to lure users to phishing or malware delivery sites, compromising user trust and potentially leading to credential theft or broader compromise.