The User Registration & Membership plugin for WordPress versions up to 5.1.4 contains an open redirect vulnerability (CWE-601) via the 'redirect_to_on_logout' GET parameter. This parameter is passed directly to wp_redirect() instead of the safer wp_safe_redirect(), allowing attackers to craft URLs that redirect users to arbitrary external sites after logout. The sanitization function esc_url_raw() does not restrict redirects to the local domain, enabling potential phishing attacks by redirecting users to malicious URLs. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity. There is no vendor advisory or patch available at this time, and no known exploits have been reported.

Successful exploitation allows an attacker to redirect users to arbitrary external URLs after logout, which could facilitate phishing attacks by leading users to malicious sites. The vulnerability impacts confidentiality and integrity to a limited extent but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with logout redirect URLs and consider disabling or restricting the use of the 'redirect_to_on_logout' parameter if possible. Monitoring official plugin updates and applying any future patches promptly is recommended.