CVE-2024-54255: Login Widget Open Redirect Vulnerability

CVE-2024-54255 Overview

CVE-2024-54255 is an open redirect vulnerability in the aviplugins.com Login Widget With Shortcode plugin for WordPress. The flaw affects the login-sidebar-widget plugin in all versions up to and including 6.1.2. Attackers can craft URLs that redirect users from a legitimate WordPress site to an attacker-controlled destination, enabling phishing campaigns that leverage the trusted domain. The issue is classified under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Attackers can weaponize the trusted plugin domain to deliver convincing phishing pages, harvest credentials, and bypass user suspicion of malicious links.

Affected Products

aviplugins.com Login Widget With Shortcode (login-sidebar-widget)
All versions from initial release through 6.1.2
WordPress installations using the plugin for login functionality

Discovery Timeline

2024-12-09 - CVE CVE-2024-54255 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54255

Vulnerability Analysis

The Login Widget With Shortcode plugin fails to validate redirect destinations supplied through user-controllable parameters. The plugin accepts a redirect target and forwards the browser without confirming the destination belongs to the same origin or an allow-listed host. This lets attackers pass an external URL and send authenticated or unauthenticated visitors to arbitrary domains.

The attack requires user interaction because the victim must click a crafted link. The scope is changed under the Common Vulnerability Scoring System, indicating impact extends beyond the vulnerable component to the browser session and any trust the user places in the originating domain. Confidentiality impact is limited to information that a phishing page can extract from a deceived user.

Root Cause

The root cause is missing or insufficient input validation on the redirect parameter used by the login widget. The plugin performs a client- or server-side redirection based on a value that an attacker controls. No allow-list, origin check, or relative-path enforcement constrains the destination, satisfying the conditions for CWE-601.

Attack Vector

An attacker constructs a URL pointing at a vulnerable WordPress site and appends a malicious redirect parameter targeting an attacker-controlled domain. The attacker distributes the URL via email, social media, or messaging. When the victim clicks the link, the WordPress site responds with a redirect to the attacker's phishing page. Because the initial hostname belongs to a legitimate site, security controls that inspect the first-hop URL and users who verify the domain before clicking are both bypassed.

No verified proof-of-concept code is published. See the Patchstack advisory for additional technical detail.

Detection Methods for CVE-2024-54255

Indicators of Compromise

Web server access logs showing requests to Login Widget With Shortcode endpoints containing external URLs in redirect-related query parameters.
HTTP 302 or 301 responses from the plugin whose Location header points to a domain outside the WordPress site.
Referrer traffic on unfamiliar external domains originating from the affected WordPress host.

Detection Strategies

Parse WordPress access logs and flag requests to login-sidebar-widget paths where a redirect parameter contains an absolute URL with an external hostname.
Deploy web application firewall rules that inspect redirect parameters and block values pointing to non-allow-listed domains.
Monitor outbound Location headers from the WordPress server and alert when they resolve to newly registered or low-reputation domains.

Monitoring Recommendations

Correlate user reports of phishing pages with access logs on the WordPress host to identify abused URLs.
Track email gateway telemetry for inbound messages containing links to the affected site with suspicious query strings.
Review authentication logs for credential-stuffing patterns that follow phishing waves referencing the affected domain.

How to Mitigate CVE-2024-54255

Immediate Actions Required

Inventory WordPress deployments and identify sites running Login Widget With Shortcode version 6.1.2 or earlier.
Disable or remove the plugin on affected sites until a patched release is confirmed and installed.
Notify users of the risk and instruct them to inspect URLs before clicking links that appear to originate from the site.

Patch Information

At the time of the NVD entry, versions through 6.1.2 are affected and no fixed version is listed in the reference data. Consult the Patchstack advisory for updates on patched releases and apply them as soon as the vendor publishes a fix.

Workarounds

Remove the login-sidebar-widget plugin and replace it with a maintained login widget that validates redirect targets.
Configure a web application firewall to strip or block absolute URLs in redirect parameters sent to plugin endpoints.
Restrict outbound redirects at the reverse proxy by rewriting Location headers that point to unapproved domains.

bash

# Example ModSecurity rule blocking external redirect targets on the plugin endpoint
SecRule REQUEST_URI "@contains login-sidebar-widget" \
    "chain,phase:2,deny,status:403,id:1005401,msg:'CVE-2024-54255 open redirect attempt'"
    SecRule ARGS "@rx ^https?://(?!yourdomain\.com)" "t:none,t:lowercase"