CVE-2024-13888: WPMobile.App Open Redirect Vulnerability

CVE-2024-13888 Overview

CVE-2024-13888 is an open redirect vulnerability in the WPMobile.App plugin for WordPress. The flaw affects all plugin versions up to and including 11.56. The plugin fails to validate the redirect parameter before issuing an HTTP redirect. Unauthenticated attackers can craft URLs that send victims to attacker-controlled destinations. Successful exploitation requires user interaction, typically by clicking a specially crafted link. The vulnerability is classified as [CWE-601] URL Redirection to Untrusted Site.

Critical Impact
Attackers can weaponize trusted WordPress domains to redirect visitors to phishing pages, malware downloads, or credential-harvesting sites while bypassing URL reputation checks.

Affected Products

Amauri WPMobile.App plugin for WordPress, versions up to and including 11.56
WordPress sites with the WPMobile.App plugin installed and active
Any downstream mobile application builds relying on the vulnerable plugin endpoint

Discovery Timeline

2025-02-20 - CVE-2024-13888 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13888

Vulnerability Analysis

The WPMobile.App plugin exposes a redirect handler that accepts a URL through the redirect query parameter. The handler issues an HTTP location response using the supplied value without validating that the target belongs to an allow-listed host or matches the site's own domain. Attackers exploit this trust boundary by embedding external URLs in crafted links that appear to originate from the legitimate WordPress site. Because the initial hop resolves to a trusted domain, users, email filters, and URL reputation services frequently treat the link as safe.

Exploitation requires social engineering. The attacker must convince a target to click the malicious URL. Once clicked, the browser follows the redirect chain and lands on the attacker-controlled destination. The scope changes because the vulnerable component sends the user to a resource outside the original site's security context.

Root Cause

The root cause is insufficient input validation on the redirect parameter. The plugin trusts client-supplied values and issues a redirect without host allow-listing, relative-path enforcement, or URL parsing checks. Reference the WordPress Trac Changeset for the vendor's remediation commit.

Attack Vector

The attack vector is network based and requires user interaction. An attacker constructs a URL of the form https://victim-site.example/?redirect=https://attacker.example/phish. The link is delivered through phishing email, chat messages, comments, or search engine poisoning. When the victim clicks, the vulnerable plugin issues a Location header pointing to the attacker's domain. Attackers typically pair this with credential-harvesting pages that clone the WordPress site's login screen.

No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2024-13888

Indicators of Compromise

Web server access logs containing requests with a redirect query parameter pointing to external hostnames
HTTP 302 responses from WPMobile.App plugin endpoints with Location headers referencing non-local domains
Spikes in outbound referrer traffic from the WordPress site to unfamiliar third-party domains
User reports of unexpected redirection to login prompts or download prompts after clicking site links

Detection Strategies

Inspect web access logs for requests containing redirect=http or redirect=// patterns targeting the plugin
Deploy a web application firewall rule that flags outbound redirects to domains outside the site's allow list
Correlate email gateway telemetry with WordPress access logs to identify phishing campaigns abusing the redirect
Baseline typical referrer patterns and alert on statistically anomalous redirect destinations

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward events to a central SIEM for correlation
Monitor plugin update status across all managed WordPress instances to identify outdated deployments
Track user-reported phishing attempts that reference the affected domain in the URL chain

How to Mitigate CVE-2024-13888

Immediate Actions Required

Update the WPMobile.App plugin to the latest version above 11.56 on every affected WordPress site
Audit all installed WordPress plugins for outdated versions and remove any unmaintained components
Review web server logs for prior exploitation attempts using the redirect parameter
Notify site users of active phishing risk and encourage verification of destination URLs before entering credentials

Patch Information

The vendor addressed the issue in the plugin release referenced by the WordPress Trac Changeset 3243366. Consult the WP App Ninja Developer Info page for current release details and upgrade instructions.

Workarounds

Deactivate the WPMobile.App plugin until the site can be patched if immediate updating is not feasible
Add a web application firewall rule that blocks requests where the redirect parameter contains an absolute external URL
Enforce a Content Security Policy and Referrer-Policy header to reduce information leakage during redirect chains
Restrict plugin endpoints to authenticated sessions where operationally acceptable

bash

# Example WAF rule (ModSecurity) blocking external redirect targets
SecRule ARGS:redirect "@rx ^(https?:)?//(?!victim-site\.example)" \
    "id:1013888,phase:2,deny,status:403,log,\
     msg:'CVE-2024-13888 external redirect blocked'"