CVE-2026-81423: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') in Accept Stripe Payments

CVE-2026-81423 is an open redirect vulnerability (CWE-601) in the Accept Stripe Payments WordPress plugin versions prior to 2.1.4. The plugin fails to validate user-supplied URLs before performing redirects, enabling unauthenticated attackers to redirect visitors to arbitrary external sites. This can facilitate phishing attacks by redirecting users to malicious domains. The vulnerability is publicly known and assigned a medium CVSS score of 4.3, but no vendor advisory or patch information is currently provided.

An attacker can exploit this vulnerability to redirect users from a legitimate site using the vulnerable plugin to arbitrary external websites. This can be leveraged for phishing attacks, potentially deceiving users into divulging sensitive information or downloading malware. There is no direct impact on confidentiality or availability, but the integrity of user navigation is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with URLs involving redirects in the Accept Stripe Payments plugin and consider implementing additional validation or blocking of suspicious redirect parameters at the application or web server level.