Quick answers
- Is CVE-2026-88791 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-88791 being exploited in the wild.
- How severe is CVE-2026-88791?
- Informational severity, published 30 September 2026.
- Which products and versions are affected?
- 10up Safe Redirect Manager before 2.3.0.
- Is there a fix for CVE-2026-88791?
- A patch was published on 2026-09-30: Fix released in version 2.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-88791 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-88791?
- Check whether you run 10up Safe Redirect Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an open redirect (CWE-601) in the Safe Redirect Manager plugin's wildcard redirect rule handling. When a wildcard redirect rule to an absolute URL is configured, the plugin does not validate the destination, allowing an unauthenticated attacker to craft a request path that redirects to an attacker-controlled URL. This requires the plugin to be installed and a wildcard redirect rule to be configured by an administrator.
Affected products
- 10up Safe Redirect Manager before 2.3.0
Timeline
- 2026-09-28: disclosed
- 2026-09-30: patched: Fix released in version 2.3.0