WordPress Open Redirect

Open Redirect is a vulnerability by which a web application fails to authenticate URLs. This will lead to attackers directing the end users to malicious sites to extract information.

Server that uses a vulnerable version of WordPress(2.9.2-4.8.1). It can be vulnerable to an open redirect attack. It could easily be done in user edit and edit tag form. Unvalidated Redirects and Forwards by this server allow redirecting a user to a new website without any proper validation of the target redirect.

Impact and Fixes

Written by

Sooraj V Nair

Cyber Security Engineer

Sooraj was probably the kid who opened up a remote control just to see what was inside, then had to figure out how to put it back together before anyone noticed. That curiosity eventually found its way into cybersecurity, where breaking things is actually part of the job description. Today, he explores vulnerabilities, analysis threats, and helps build safer digital spaces. His favourite question remains the same: “What happens if I try this?”