The vulnerability CVE-2026-25392 involves an open redirect flaw in the KaizenCoders Update URLs WordPress plugin (versions up to 1.4.1). This flaw allows an attacker to craft URLs that redirect users to untrusted external websites, potentially enabling phishing attacks by exploiting user trust. The vulnerability requires user interaction (UI:R) and has no required privileges (PR:N), with network attack vector (AV:N). The impact is limited to partial confidentiality loss due to phishing risks, with no integrity or availability impact. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

The primary impact is the potential for phishing attacks by redirecting users to malicious external sites. There is no direct compromise of system integrity or availability. Confidentiality impact is limited to user deception rather than data breach. The medium severity rating reflects the moderate risk posed by user redirection without authentication requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking URLs generated by or related to this plugin. Monitoring for updates from KaizenCoders or the WordPress plugin repository is recommended to apply any forthcoming patches promptly.