The Rustaurius Ultimate WP Mail plugin suffers from an Open Redirect vulnerability (CVE-2025-32694) in versions up to 1.3.10. This flaw allows attackers to redirect users to untrusted external websites via crafted URLs, which can be exploited for phishing purposes. The CVSS 3.1 base score is 4.7 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality impact. No known exploits are reported in the wild. No patch or vendor advisory is currently available.

The vulnerability enables attackers to redirect users to malicious websites, increasing the risk of phishing attacks. It does not directly compromise system confidentiality, integrity, or availability. The medium severity reflects the potential for social engineering attacks rather than direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with URLs generated by or related to the Ultimate WP Mail plugin and consider implementing additional URL validation or user warnings to mitigate phishing risks.