CVE-2025-12569

Vulnerability

Overview

The WP Front User Submit plugin (also known as Front Editor) before version 5.0.0 contains an open redirect vulnerability (CWE-601). The plugin fails to validate a parameter before using it to redirect the user, allowing an attacker to supply an arbitrary external URL as the redirect destination [1].

Exploitation

An attacker can craft a malicious link that includes a manipulated redirect parameter. When a user clicks the link, the plugin processes the parameter and redirects the user to the attacker-controlled site. The vulnerability is accessible through the guest posting or frontend posting functionality, and no authentication is required to trigger the redirect [1].

Impact

Successful exploitation enables phishing attacks, where users are redirected to lookalike login pages or malicious sites that distribute malware or steal credentials. The open redirect can also be used to bypass URL validation in other contexts, such as in email campaigns or social engineering attacks [1].

Mitigation

The vulnerability is fixed in version 5.0.0 of the plugin. Users are strongly advised to update to the latest version immediately. No workarounds are documented [1].