The Export WP Page to Static HTML/CSS plugin for WordPress suffers from an Open Redirect vulnerability (CWE-601) due to improper validation of the redirect URL parameter rc_exported_zip_file. This flaw affects all versions up to and including 2.2.2. An unauthenticated attacker can exploit this by persuading users to follow crafted links that redirect them to untrusted external sites, potentially facilitating phishing or other malicious activities. The vulnerability is publicly disclosed with a CVSS 3.1 score of 7.1, indicating high severity. No patch or remediation details are currently available from the vendor, and the plugin is not a cloud service, so remediation depends on plugin updates.

Successful exploitation allows an unauthenticated attacker to redirect users to arbitrary external URLs, which can lead to phishing attacks or exposure to malicious sites. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector (C:L/I:L/A:L). There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking on suspicious links involving the vulnerable plugin's parameters. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.