Executive brief
The User Registration & Membership WordPress plugin before version 5.2.8 fails to validate where users are redirected after login. An attacker can trick a visitor into being sent to a malicious external website by crafting a deceptive link or form, creating a phishing opportunity that exploits the trusted WordPress site as a launchpad for credential theft or malware distribution.
Technical details
This is an open redirect vulnerability (CWE-601) in the login redirect functionality. The plugin accepts redirect parameters from multiple sources—including the HTTP referer header, POST parameters, and AJAX requests—without validating that the destination is internal to the site. An unauthenticated attacker can craft a request with an arbitrary external URL in the redirect parameter; on both successful and failed login attempts, the plugin redirects the user to the attacker's domain. No valid credentials are required for some attack vectors (step 2 in the PoC). The vulnerability affects both standard HTTP 302 redirects and AJAX-based logins. Patched in version 5.2.8.
Affected products
- WP Desk User Registration & Membership before 5.2.8
Timeline
- 2026-09-11: disclosed
- 2026-09-13: patched: Fixed in version 5.2.8