CVE-2025-14451 is an open redirect vulnerability (CWE-601) in the Solutions Ad Manager plugin for WordPress, affecting all versions up to and including 1.0.0. The issue arises from insufficient validation of the 'sam-redirect-to' URL parameter, enabling unauthenticated attackers to redirect users to arbitrary external sites. This vulnerability requires user interaction (UI:R) and has no impact on confidentiality or availability but can impact integrity by redirecting users to malicious destinations. The CVSS 3.1 base score is 4.7 (medium severity). No patch or official remediation has been published by the vendor as of the published date.

Successful exploitation allows attackers to redirect users from the vulnerable WordPress site to arbitrary external URLs. This can facilitate phishing or other social engineering attacks by leading users to malicious websites. The vulnerability does not directly compromise system confidentiality or availability but can undermine user trust and potentially lead to secondary attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with URLs containing the 'sam-redirect-to' parameter and consider implementing temporary mitigations such as input validation or URL filtering at the web application or firewall level to restrict redirection to trusted domains.