CVE-2025-30795 describes an Open Redirect vulnerability in the Aman FunnelKit Automations WordPress plugin (versions up to 3.5.1). The issue allows attackers to redirect users to arbitrary external URLs via crafted links, potentially enabling phishing attacks. The vulnerability has a CVSS 3.1 base score of 4.7 (medium severity), with an attack vector of network, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality. No patch or remediation information is currently provided, and no known exploits have been reported.

The vulnerability enables attackers to redirect users to untrusted external websites, which can be used to conduct phishing attacks. The impact on confidentiality is low, and there is no direct impact on integrity or availability. Exploitation requires user interaction and can be performed remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with URLs generated by or related to FunnelKit Automations and consider implementing web application firewall (WAF) rules to detect and block suspicious redirects.