The vulnerability identified as CVE-2025-64250 affects the wpWax Directorist plugin (versions up to 8.6.6). It is an Open Redirect flaw where crafted URLs can redirect users to untrusted external websites. This can be leveraged for phishing attacks by deceiving users into visiting malicious sites. The vulnerability requires no privileges and user interaction is needed to trigger the redirect. The CVSS 3.1 base score is 4.7, reflecting medium severity with network attack vector, low attack complexity, no privileges required, and user interaction required. The vulnerability does not impact data confidentiality, integrity, or availability directly but can facilitate social engineering attacks.

The primary impact is the potential facilitation of phishing attacks through user redirection to malicious external sites. There is no direct compromise of data confidentiality, integrity, or availability within the affected software. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious of URLs originating from affected versions of the wpWax Directorist plugin and consider implementing web application firewall (WAF) rules to detect and block suspicious redirect patterns. Monitor vendor communications for updates on patches or official mitigations.