CVE-2026-88791

Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules

The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.

Affected

Safe Redirect Manager

CVSS v3.1 CNA

3.4 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N

EPSS

0.18% chance of exploitation in the next 30 days, 7th percentile

Published

2026-09-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a8aa5685-e36e-4e1f-a259-fab3910ee550/

References

• CVE Record
• NVD entry