The User Registration & Membership plugin for WordPress versions up to and including 5.1.4 contains an open redirect vulnerability (CWE-601) due to improper validation of the 'redirect_to_on_logout' GET parameter. This parameter is passed directly to WordPress's wp_redirect() function rather than the safer wp_safe_redirect(), allowing redirection to arbitrary external URLs. Although esc_url_raw() is used to sanitize URLs, it does not restrict redirects to the local domain, enabling attackers to redirect users to potentially malicious external sites after logout. This vulnerability could be leveraged in phishing attacks. The CVSS 3.1 base score is 6.1, indicating medium severity. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an attacker to redirect users to arbitrary external websites after logout by manipulating the 'redirect_to_on_logout' parameter. This could facilitate phishing attacks by directing users to malicious sites that appear legitimate. The vulnerability does not directly impact confidentiality or availability but poses a risk to user trust and security through redirection to untrusted domains.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of the 'redirect_to_on_logout' parameter if possible or implement custom validation to restrict redirects to trusted domains. Monitor vendor channels for updates and apply patches promptly once released.