This vulnerability (CWE-601) in WP OAuth Server OAuth Server allows URL redirection to untrusted sites, potentially enabling phishing or redirect-based attacks. It affects all versions up to 4.3.3. The vulnerability has a CVSS 3.1 base score of 4.7, reflecting a network attack vector, low complexity, no privileges required, user interaction required, and limited confidentiality impact. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

An attacker could exploit this vulnerability to redirect users to malicious websites, potentially facilitating phishing attacks or other social engineering tactics. The confidentiality impact is low, and there is no impact on integrity or availability reported. No active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with URLs involving the WP OAuth Server plugin and consider implementing additional validation or filtering of redirect URLs if possible.