The vulnerability CVE-2024-47354 exists in the Simple Membership After Login Redirection plugin by wp.insider, versions up to 1.6. It is an Open Redirect issue where the plugin improperly validates or restricts URLs used for redirection after user login, potentially allowing redirection to untrusted external sites. This can be leveraged in phishing or social engineering attacks to redirect authenticated users to malicious websites. The CVSS 3.1 base score is 4.7, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality impact.

Successful exploitation could lead to users being redirected to malicious or untrusted websites after login, potentially facilitating phishing or social engineering attacks. There is no direct impact on confidentiality, integrity, or availability of the affected system itself. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with login redirection URLs and consider disabling or restricting the plugin's redirection functionality if possible.