This vulnerability (CWE-601) in Simple Membership plugin allows an attacker to craft URLs that redirect users to untrusted external sites. The issue affects versions up to 4.4.1 and involves improper validation of redirect targets. The CVSS 3.1 base score is 3.4, reflecting network attack vector, high complexity, no privileges required, user interaction needed, and limited confidentiality impact. No official fix or patch has been disclosed as of the publication date.

The vulnerability could be leveraged to redirect users to malicious websites, potentially facilitating phishing or social engineering attacks. However, it does not directly impact confidentiality, integrity, or availability of the affected system. The low CVSS score and requirement for user interaction reduce the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with URLs generated by the Simple Membership plugin and consider implementing additional validation or filtering of redirect URLs within their environment.