CVE-2026-88791CWE-601

CVE-2026-88791

Low · published September 30, 2026

CVSS v3.1
3.4
EPSS
0%
Percentile
7.0
In the wild
Unconfirmed
What it is

The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.

The record
Technical detail
CVSS v3.1
3.4 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00178 · 7.0th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-09-30T10:17Z
References (1)
https://wpscan.com/vulnerability/a8aa5685-e36e-4e1f-a259-fab3910ee550/ · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 0%
    epss
  • 30 SEP 06:00Z
    Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules
    cvelistv5