CVE-2025-24741: KB Support Open Redirect Vulnerability

CVE-2025-24741 Overview

CVE-2025-24741 is an open redirect vulnerability in the KB Support WordPress plugin developed by LOGON. The flaw affects all versions of KB Support up to and including 1.6.7. Attackers can craft URLs that appear to originate from a trusted site but redirect victims to attacker-controlled destinations. The issue is tracked under CWE-601: URL Redirection to Untrusted Site.

Exploitation requires user interaction, typically through a phishing link. Successful attacks enable credential theft, malware delivery, and social engineering campaigns that abuse the trust associated with the vulnerable WordPress site.

Critical Impact
Attackers can redirect authenticated or unauthenticated visitors from a trusted WordPress site running KB Support to malicious external destinations, enabling phishing and credential harvesting.

Affected Products

KB Support WordPress plugin versions up to and including 1.6.7
WordPress sites installed with the vulnerable LOGON kb-support plugin
Any support portal or helpdesk deployment relying on this plugin for ticketing

Discovery Timeline

2025-01-27 - CVE-2025-24741 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24741

Vulnerability Analysis

The vulnerability resides in the KB Support plugin's redirect handling logic. The plugin accepts a user-supplied destination parameter and forwards the browser to that location without validating whether the target belongs to an allowlisted domain. Attackers embed a malicious URL in the redirect parameter and distribute the composed link through email, chat, or social media.

Because the initial hostname belongs to a legitimate WordPress site running KB Support, victims and email security controls treat the link as trustworthy. Once the browser processes the redirect, the user lands on an attacker-controlled page that may impersonate the original site or deliver malware.

The attack proceeds over the network without authentication, though it depends on user interaction. Impact is limited to confidentiality and integrity of the redirected session, with a scope change because the attack affects resources beyond the vulnerable component. The current EPSS probability is 0.233%.

Root Cause

The plugin fails to validate or sanitize the redirect target parameter against a list of trusted hosts. Input flows from an HTTP request parameter directly into a redirect response header without host comparison, protocol filtering, or relative-path enforcement.

Attack Vector

An attacker crafts a URL pointing to the vulnerable WordPress site with a manipulated redirect parameter. The victim clicks the link, believing it leads to a legitimate support resource. The KB Support plugin issues an HTTP redirect that sends the browser to the attacker's domain, which typically hosts a phishing page mirroring the original site's branding.

Refer to the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-24741

Indicators of Compromise

HTTP requests to KB Support endpoints containing external URLs in redirect-related query parameters
Web server access logs showing 302 or 301 responses with Location headers pointing to domains outside the site's own hostname
Referrer headers on external phishing infrastructure originating from the vulnerable WordPress domain
User reports of unexpected redirects after clicking links that appeared to point to the support portal

Detection Strategies

Inspect WordPress access logs for query strings containing fully qualified URLs, protocol-relative paths (//attacker.tld), or encoded schemes such as %2F%2F
Deploy web application firewall rules that flag redirect parameters whose values do not match the site's own hostname
Correlate outbound redirect responses with downstream reports of phishing pages hosted on newly registered domains

Monitoring Recommendations

Baseline the normal set of Location header destinations produced by KB Support endpoints and alert on deviations
Monitor for spikes in traffic to KB Support URLs containing redirect parameters, which often precede phishing campaigns
Track user reports and email gateway telemetry for messages linking to the vulnerable site

How to Mitigate CVE-2025-24741

Immediate Actions Required

Identify all WordPress installations running the KB Support plugin at version 1.6.7 or earlier
Update KB Support to a version later than 1.6.7 once the vendor publishes a fix, per the Patchstack advisory
Notify support portal users about phishing risk and instruct them to verify URLs before submitting credentials

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Administrators should monitor the Patchstack Vulnerability Report and the WordPress plugin repository for an updated release addressing CVE-2025-24741.

Workarounds

Deploy a web application firewall rule that blocks requests to KB Support endpoints when redirect parameters contain external hostnames or // sequences
Disable or remove the KB Support plugin until a patched version becomes available if the ticketing functionality is not business-critical
Enforce strict Referrer-Policy and educate users to inspect the final destination of support links before authenticating

bash

# Example nginx rule to block external redirects targeting KB Support endpoints
location ~* /(kb-support|kbs) {
    if ($arg_redirect_to ~* "^https?://(?!yoursite\.example\.com)") {
        return 403;
    }
}