CVE-2025-28896: AS English Admin Open Redirect Flaw

CVE-2025-28896 Overview

CVE-2025-28896 is an open redirect vulnerability in the Akshar Soft Solutions AS English Admin WordPress plugin (as-english-admin). The flaw affects all versions up to and including 1.0.0. Attackers can craft URLs that redirect users from the trusted WordPress site to attacker-controlled destinations. This weakness enables phishing campaigns that leverage the legitimacy of the host domain to trick victims into disclosing credentials or executing further actions. The vulnerability is classified under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
An unauthenticated attacker can abuse the plugin to redirect users to malicious domains, facilitating phishing and credential theft against WordPress site visitors.

Affected Products

Akshar Soft Solutions AS English Admin WordPress plugin
All versions from n/a through 1.0.0
WordPress installations with the as-english-admin plugin enabled

Discovery Timeline

2025-03-11 - CVE-2025-28896 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-28896

Vulnerability Analysis

The AS English Admin plugin fails to validate a user-supplied redirect parameter against an allow-list of trusted destinations. When a victim clicks a crafted link pointing to the legitimate WordPress domain, the plugin forwards the browser to an attacker-controlled URL. Because the initial hostname belongs to the trusted site, security-aware users, email gateways, and URL reputation systems may treat the link as safe.

User interaction is required for exploitation. The attacker must convince a victim to click the malicious link, typically through email, chat, or a compromised web page. No authentication is required to construct the abusive URL, and the redirect crosses a trust boundary from the WordPress host to an external site.

Root Cause

The root cause is missing input validation on a redirect parameter processed by the plugin. The code passes attacker-controlled input directly into a location header or client-side navigation call without verifying that the target URL resolves to the same origin or an approved allow-list.

Attack Vector

Exploitation occurs over the network. An attacker builds a URL hosted on the vulnerable WordPress site that embeds a redirect, url, or similar parameter pointing to a phishing page. The victim clicks the link, the plugin issues an HTTP redirect, and the browser lands on the attacker's site. The attacker can then serve a cloned login page or malware payload while retaining the trust signals of the original domain in email previews and referrer headers.

No verified proof-of-concept code is publicly available. Refer to the Patchstack WordPress Vulnerability Report for technical details.

Detection Methods for CVE-2025-28896

Indicators of Compromise

HTTP 302 or 301 responses from the WordPress host with Location headers pointing to external, unaffiliated domains
Access log entries containing redirect query parameters such as ?url=, ?redirect=, or ?next= with fully qualified external URLs
Spikes in outbound clicks from the WordPress domain to newly registered or low-reputation destinations
Referrer headers on phishing sites showing the vulnerable WordPress host as the origin

Detection Strategies

Inspect web server access logs for requests to as-english-admin endpoints containing URL-encoded external destinations in query strings
Deploy a web application firewall (WAF) rule that flags redirect parameters resolving to domains outside the site's approved list
Monitor email security gateways for outbound phishing lures that embed the WordPress domain as the initial hop

Monitoring Recommendations

Enable verbose HTTP logging on the WordPress reverse proxy to capture full request URIs and response Location headers
Alert on any 3xx response where the redirect target host does not match the site's own domain
Correlate user click telemetry from email and browser isolation platforms with WordPress access logs to identify abuse patterns

How to Mitigate CVE-2025-28896

Immediate Actions Required

Deactivate the AS English Admin plugin (as-english-admin) until a patched release is available
Audit WordPress installations for the presence of the plugin and inventory affected sites
Educate site administrators and end users about phishing links that appear to originate from the trusted WordPress domain

Patch Information

No vendor patch has been published for versions above 1.0.0 at the time of the NVD record. Consult the Patchstack advisory for the latest remediation status and any virtual patching options.

Workarounds

Remove the as-english-admin plugin from all WordPress sites and replace it with a maintained alternative
Add WAF rules that reject requests containing redirect parameters with values matching https?:// when the host differs from the site domain
Restrict access to plugin endpoints via .htaccess or Nginx location blocks until removal is complete

bash

# Configuration example
# Nginx rule to block external redirect parameters targeting the plugin
location ~* /wp-content/plugins/as-english-admin/ {
    if ($arg_url ~* "^https?://(?!yoursite\.com)") { return 403; }
    if ($arg_redirect ~* "^https?://(?!yoursite\.com)") { return 403; }
    if ($arg_next ~* "^https?://(?!yoursite\.com)") { return 403; }
}