The vulnerability CVE-2025-68602 involves an Open Redirect issue in the Accept Donations with PayPal & Stripe plugin by Scott Paterson. This flaw allows attackers to craft URLs that redirect users to untrusted external websites, potentially enabling phishing attacks. The affected versions are up to 1.5.2. The CVSS 3.1 base score is 4.7 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality impact. No patch or official remediation guidance is currently documented.

The primary impact is the potential for phishing attacks due to the ability to redirect users to malicious external sites. Confidentiality impact is limited, and there is no direct impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when clicking on URLs associated with this plugin and consider implementing additional controls such as URL validation or user awareness training to mitigate phishing risks.