CVE-2025-30781 Overview
CVE-2025-30781 is an open redirect vulnerability in the WPFactory Scheduled & Automatic Order Status Controller for WooCommerce plugin. The flaw affects all plugin versions up to and including 3.7.1. Attackers can craft URLs that redirect victims from the trusted WordPress site to attacker-controlled destinations. The issue is classified under CWE-601 (URL Redirection to Untrusted Site). Threat actors typically weaponize this class of flaw for phishing campaigns that abuse the trusted domain reputation of the vulnerable site.
Critical Impact
Attackers can leverage the trusted WooCommerce store domain to redirect shoppers to phishing or malware-hosting sites, harvesting credentials and payment data.
Affected Products
- WPFactory Scheduled & Automatic Order Status Controller for WooCommerce (order-status-rules-for-woocommerce)
- Plugin versions from n/a through 3.7.1
- WordPress sites running WooCommerce with the affected plugin installed
Discovery Timeline
- 2025-03-27 - CVE-2025-30781 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30781
Vulnerability Analysis
The plugin accepts a redirect target from a request parameter and forwards the browser without validating the destination against an allowlist of trusted hosts. An attacker crafts a URL pointing to the vulnerable endpoint on a legitimate WooCommerce site, appending a redirect parameter that references an external, attacker-controlled domain. When the victim clicks the link, the browser first contacts the trusted store, then follows the server-issued redirect to the malicious site. Because the initial hostname is legitimate, users, email gateways, and URL reputation systems are more likely to trust the link. Exploitation requires user interaction, which is why the flaw scores in the medium range rather than higher.
Root Cause
The root cause is missing validation on a URL parameter used to construct a redirect response. The plugin trusts client-supplied input and issues an HTTP redirect without confirming that the target host matches the site origin or a maintained allowlist. This is a textbook CWE-601 pattern.
Attack Vector
Exploitation occurs over the network and requires no authentication. The attacker distributes a link that points to the vulnerable WooCommerce endpoint, embedding a malicious redirect target. Victims must click the link for the redirect to execute. Common delivery channels include phishing emails, malicious ads, forum posts, and social media messages.
No verified exploit code has been published. Refer to the PatchStack advisory for technical details.
Detection Methods for CVE-2025-30781
Indicators of Compromise
- Outbound HTTP 301/302 responses from the WooCommerce site containing Location headers pointing to external domains not owned by the store operator.
- Web server access logs showing requests to order-status-rules-for-woocommerce endpoints with URL-encoded external hostnames in query parameters.
- Referrer traffic in analytics platforms showing users arriving at unknown third-party domains after visiting the store.
Detection Strategies
- Inspect web application firewall (WAF) logs for requests to the plugin path containing http://, https://, or // sequences in query string values.
- Correlate email gateway telemetry with click-through logs on the WooCommerce domain to detect phishing lures abusing the store URL.
- Compare the Host header on inbound requests against the Location header on redirect responses to flag mismatches.
Monitoring Recommendations
- Enable verbose access logging on the WordPress reverse proxy or CDN and retain logs long enough for retrospective phishing investigations.
- Alert on anomalous spikes in redirect responses (3xx) originating from plugin endpoints.
- Monitor brand mentions and URL shortener services for links that chain through the store domain to unrelated destinations.
How to Mitigate CVE-2025-30781
Immediate Actions Required
- Update the WPFactory Scheduled & Automatic Order Status Controller for WooCommerce plugin to a version later than 3.7.1 as soon as the vendor publishes a fix.
- If no patched version is yet available, deactivate and remove the plugin until a fixed release is confirmed.
- Notify customers and staff to be cautious of unexpected redirects originating from the store domain.
Patch Information
At the time of the NVD entry, the advisory lists affected versions up to and including 3.7.1. Review the PatchStack advisory for the latest fixed-version guidance and vendor coordination status.
Workarounds
- Deploy a WAF rule that blocks requests to the plugin path when query parameters contain absolute URLs or protocol-relative prefixes (//).
- Configure the reverse proxy to strip or rewrite Location response headers pointing to external hosts on plugin endpoints.
- Restrict administrative access to the plugin configuration to trusted networks while the vulnerability is unpatched.
# Example ModSecurity rule to block absolute URLs in redirect parameters
SecRule REQUEST_URI "@contains order-status-rules-for-woocommerce" \
"chain,phase:2,deny,status:403,id:1030781,msg:'CVE-2025-30781 open redirect attempt'"
SecRule ARGS "@rx ^(https?:)?//" "t:none,t:urlDecodeUni"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
