CVE-2025-11167: WordPress CM Registration Open Redirect

CVE-2025-11167 Overview

CVE-2025-11167 is an Open Redirect vulnerability [CWE-601] affecting the CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress. All versions up to and including 2.5.6 are vulnerable. The flaw stems from insufficient validation of the redirect_url parameter processed by the plugin's login controller. Unauthenticated attackers can craft URLs that redirect victims to attacker-controlled destinations after user interaction. This behavior enables phishing campaigns and credential harvesting when victims are tricked into clicking crafted links.

Critical Impact
Unauthenticated attackers can redirect WordPress users to arbitrary external sites through the redirect_url parameter, enabling phishing and social engineering attacks against site visitors.

Affected Products

CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress
All versions up to and including 2.5.6
Fixed in version 2.5.7 (per WordPress plugin changeset 3374121)

Discovery Timeline

2025-10-11 - CVE-2025-11167 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11167

Vulnerability Analysis

The vulnerability resides in the plugin's LoginController.php, which handles post-authentication redirection logic. The controller accepts a client-supplied redirect_url parameter and passes it to the redirect function without validating whether the destination points to the same origin as the WordPress site. Because no allowlist or host comparison is enforced, arbitrary absolute URLs including external attacker-controlled domains are accepted as valid targets.

An attacker constructs a link pointing at the vulnerable WordPress endpoint with redirect_url set to a malicious site. When a legitimate user clicks the link and completes the requested action, the plugin issues an HTTP redirect to the attacker's destination. The victim's browser follows the redirect while trusting the initial legitimate WordPress hostname visible in the original URL.

Root Cause

The root cause is missing server-side validation of URL destinations before issuing redirects. The plugin should apply WordPress core functions such as wp_safe_redirect() or explicitly validate that redirect targets match the site host. Instead, the controller trusts the client-supplied value, meeting the definition of URL Redirection to Untrusted Site [CWE-601].

Attack Vector

Exploitation requires network access to the target WordPress site and user interaction. An attacker distributes a crafted URL through email, chat, or social media. The URL points to the legitimate WordPress domain but includes a redirect_url parameter targeting an attacker-controlled page. Victims performing the triggering action are redirected off-site, often to phishing pages that clone the original site's login form. The vulnerability does not require authentication or elevated privileges to trigger.

// Example request pattern (conceptual)
GET /wp-login-endpoint?redirect_url=https://attacker.example/phish HTTP/1.1
Host: victim-wordpress.example

Detection Methods for CVE-2025-11167

Indicators of Compromise

Inbound requests containing a redirect_url parameter with values pointing to external, non-site hostnames
HTTP 302 responses from WordPress endpoints with Location headers referencing untrusted domains
Web server access logs showing repeated requests to plugin login endpoints from a small set of source IPs
Referrer headers on user reports of phishing pages that match the WordPress site's login URL

Detection Strategies

Inspect WordPress access logs for redirect_url values that fail a same-origin host comparison against the site domain
Deploy a Web Application Firewall (WAF) rule that flags or blocks external URLs supplied to redirect_url on the CM Registration plugin routes
Correlate outbound redirect responses with downstream user reports of phishing to identify active abuse

Monitoring Recommendations

Alert on HTTP 3xx responses from LoginController.php routes where the Location header host does not match the site host
Monitor threat intelligence feeds for domains being paired with the vulnerable site in phishing lures
Track anomalous spikes in traffic to plugin login endpoints, especially with query strings containing URL-encoded external hosts

How to Mitigate CVE-2025-11167

Immediate Actions Required

Update the CM Registration plugin to a version above 2.5.6 that incorporates the fix from WordPress plugin changeset 3374121
Audit WordPress site logs for prior exploitation attempts referencing the redirect_url parameter
Notify users who may have clicked suspicious links referencing the site's login endpoint

Patch Information

The vendor addressed the flaw in the plugin's LoginController.php. Review the WordPress Plugin Changeset for the exact code changes. Additional analysis is available in the Wordfence Vulnerability Report.

Workarounds

Disable the CM Registration plugin until the patched version is installed
Add a WAF rule that rejects requests where redirect_url does not begin with the site's own scheme and host
Restrict access to plugin login endpoints via IP allowlisting where operationally feasible

bash

# Example WAF rule (ModSecurity) rejecting external redirect_url values
SecRule ARGS:redirect_url "!@beginsWith https://victim-wordpress.example/" \
    "id:1011167,phase:2,deny,status:403,\
    msg:'CVE-2025-11167 external redirect_url blocked'"