The Affiliate Sales in Google Analytics and other tools plugin for WordPress (wecantrack) suffers from an open redirect vulnerability (CWE-601) due to improper validation of the 'afflink' URL parameter. This allows unauthenticated attackers to craft URLs that redirect users to untrusted external sites, potentially facilitating phishing or other malicious activities. The issue affects all plugin versions up to and including 2.0.0. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

An attacker can exploit this vulnerability to redirect users to malicious websites by tricking them into clicking crafted URLs containing the vulnerable 'afflink' parameter. This can facilitate phishing attacks or delivery of malicious content. The vulnerability does not directly impact system availability but can compromise user trust and confidentiality through redirection to untrusted sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when clicking links involving the 'afflink' parameter in this plugin. Consider disabling or restricting the plugin if possible to reduce exposure.