The vulnerability CVE-2025-30781 involves an open redirect issue in the WPFactory Scheduled & Automatic Order Status Controller for WooCommerce plugin (up to version 3.7.1). This flaw allows attackers to redirect users from legitimate URLs to untrusted sites, which can be leveraged for phishing. The CVSS 3.1 vector indicates the attack requires no privileges but does require user interaction, with a low complexity attack vector and partial confidentiality impact. No denial of service or integrity impacts are noted. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can lead to users being redirected to malicious websites, increasing the risk of phishing attacks. The confidentiality impact is low, and there is no impact on integrity or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with URLs generated by or related to this plugin and consider implementing web application firewall rules to detect and block suspicious redirects.