The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress suffers from an Open Redirect vulnerability (CWE-601) due to inadequate validation of the 'redirect_to' parameter. This flaw allows unauthenticated attackers to craft URLs that redirect users to untrusted external sites if the plugin is active but not configured. The vulnerability affects all versions up to and including 3.2. The CVSS 3.1 base score is 4.7, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity. A patch is available to remediate this issue.

Successful exploitation can lead to users being redirected to malicious websites, potentially facilitating phishing or other social engineering attacks. The vulnerability does not directly compromise system confidentiality, integrity, or availability but can be leveraged as part of broader attack chains. No known exploits are reported in the wild at this time.

A patch addressing this vulnerability is available and should be applied promptly. Users should update the WPO365 | MICROSOFT 365 GRAPH MAILER plugin to the fixed version beyond 3.2. Until patched, ensure the plugin is properly configured to avoid exposure. No additional vendor advisory content is provided, so check the vendor's official channels for the latest remediation guidance.