The CM Registration – Tailored tool for seamless login and invitation-based registrations WordPress plugin suffers from an open redirect vulnerability (CWE-601) due to improper validation of the 'redirect_url' parameter. This flaw allows unauthenticated attackers to craft URLs that redirect users to untrusted external sites if users follow the malicious links. The vulnerability affects all plugin versions up to and including 2.5.6. The CVSS 3.1 base score is 4.7, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality impact, limited integrity impact, and no availability impact. There are no known exploits in the wild and no vendor-provided patch or advisory confirming remediation status.

The vulnerability enables attackers to redirect users to potentially malicious websites, which can facilitate phishing or social engineering attacks. It does not directly compromise system confidentiality or availability but can undermine user trust and integrity by redirecting users without proper validation. Exploitation requires user interaction (clicking a crafted link). There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links involving the 'redirect_url' parameter in this plugin. Consider disabling or restricting the plugin if possible to reduce exposure. Monitor vendor channels for updates or patches addressing this vulnerability.