The CRM Perks Integration for WooCommerce and Salesforce plugin contains an Open Redirect vulnerability (CVE-2025-47455) that allows an attacker to redirect users to untrusted external URLs. This could be leveraged for phishing attacks by tricking users into visiting malicious sites. The vulnerability affects versions up to and including 1.7.5. The CVSS 3.1 base score is 4.7 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality impact. The product is a cloud-hosted service, and the vendor is responsible for patching and remediation.

Successful exploitation can lead to users being redirected to malicious websites, increasing the risk of phishing attacks. There is no direct impact on system integrity or availability. Confidentiality impact is limited to potential disclosure of user navigation to untrusted sites. No known active exploits have been reported.

A patch is available for this vulnerability. Since the product is a cloud-hosted service, the vendor manages remediation and typically applies patches server-side. Users and administrators should verify with the vendor advisory that the service is updated to a fixed version. No additional action is required if the vendor confirms mitigation.