CVE-2026-88791: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') in Safe Redirect Manager
The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.
AI Analysis
Technical Summary
The Safe Redirect Manager WordPress plugin prior to version 2.3.0 contains a CWE-601 open redirect vulnerability. Specifically, when a wildcard redirect rule pointing to an absolute URL is configured, the plugin does not validate the redirect destination properly. This enables unauthenticated attackers to craft request paths that redirect visitors to arbitrary external sites.
Potential Impact
An attacker can exploit this vulnerability to redirect users to malicious external websites, potentially facilitating phishing or other social engineering attacks. However, there is no indication of direct code execution or data compromise from this vulnerability alone.
Mitigation Recommendations
Upgrade the Safe Redirect Manager plugin to version 2.3.0 or later, where this vulnerability has been fixed. No other mitigation guidance is provided. Patch status is confirmed by the version boundary indicating fixed in 2.3.0.
CVE-2026-88791: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') in Safe Redirect Manager
Description
The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.
Affected software
Safe Redirect Manager
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Safe Redirect Manager WordPress plugin prior to version 2.3.0 contains a CWE-601 open redirect vulnerability. Specifically, when a wildcard redirect rule pointing to an absolute URL is configured, the plugin does not validate the redirect destination properly. This enables unauthenticated attackers to craft request paths that redirect visitors to arbitrary external sites.
Potential Impact
An attacker can exploit this vulnerability to redirect users to malicious external websites, potentially facilitating phishing or other social engineering attacks. However, there is no indication of direct code execution or data compromise from this vulnerability alone.
Mitigation Recommendations
Upgrade the Safe Redirect Manager plugin to version 2.3.0 or later, where this vulnerability has been fixed. No other mitigation guidance is provided. Patch status is confirmed by the version boundary indicating fixed in 2.3.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-10T08:03:03.141Z
- State
- PUBLISHED
Threat ID: 6abcab01236a9c741f0494b5
Added to database: 09/30/2026, 06:24:01 UTC
Last enriched: 09/30/2026, 06:39:14 UTC
Last updated: 09/30/2026, 07:39:40 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.