CVE-2024-13888 is an open redirect vulnerability (CWE-601) in the amauric WPMobile.App WordPress plugin versions up to and including 11.56. The vulnerability arises from inadequate validation of the URL supplied via the 'redirect' parameter, enabling unauthenticated attackers to redirect users to arbitrary external sites. This can facilitate phishing or other social engineering attacks by leveraging trusted site redirects. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality and integrity with scope change.

Successful exploitation allows attackers to redirect users from the vulnerable site to arbitrary external URLs. This can be used to facilitate phishing attacks or redirect users to malicious sites, potentially leading to credential theft or malware infection. The vulnerability affects confidentiality and integrity but does not impact availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious of any unexpected redirects originating from the WPMobile.App plugin. Site administrators may consider disabling or removing the plugin if feasible or implementing web application firewall (WAF) rules to detect and block suspicious redirect parameters.