CVE-2025-30859: AliNext Open Redirect Vulnerability

CVE-2025-30859 Overview

CVE-2025-30859 is an open redirect vulnerability in the guru-aliexpress AliNext (ali2woo-lite) plugin for WordPress. The flaw affects all versions up to and including 3.5.1. Attackers can craft malicious URLs that use the vulnerable plugin to redirect users to attacker-controlled domains. This behavior enables phishing campaigns that abuse the trust of the legitimate WordPress site hosting the plugin. The vulnerability is categorized under CWE-601: URL Redirection to Untrusted Site and requires user interaction to trigger.

Critical Impact
Attackers can leverage the vulnerable WordPress site as a redirection proxy to send victims to phishing or malware distribution pages while retaining the legitimate domain in the initial URL.

Affected Products

guru-aliexpress AliNext (ali2woo-lite) plugin for WordPress
All versions from n/a through 3.5.1
WordPress sites integrating AliExpress product imports via AliNext

Discovery Timeline

2025-03-27 - CVE-2025-30859 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30859

Vulnerability Analysis

The AliNext plugin accepts a user-supplied URL parameter and passes it to a redirection routine without validating that the destination points to an allowed host. The plugin fails to enforce an allowlist of trusted domains or restrict redirects to relative paths within the WordPress site. As a result, an attacker can append or manipulate the redirect parameter in a crafted link to send victims to any external location.

The issue requires user interaction, meaning the victim must click the malicious link. The attack is conducted over the network and requires no authentication. Because the redirect originates from the legitimate WordPress domain, browser and email security controls that rely on domain reputation may allow the initial request to pass.

Root Cause

The root cause is missing or insufficient validation of the redirect target URL within the plugin's request handling logic. The plugin trusts client-supplied input when constructing the destination for HTTP redirect responses. This is a classic [CWE-601] pattern where the application relies on unfiltered user input to control the Location header.

Attack Vector

An attacker builds a URL that points to a vulnerable endpoint of the AliNext plugin and embeds an attacker-controlled destination in the redirect parameter. The attacker distributes the link through email, social media, or malicious advertising. When the victim clicks the link, the WordPress site responds with an HTTP redirect that sends the browser to the attacker's phishing page. The victim sees the trusted domain during the initial request, which improves the credibility of the phishing lure.

Refer to the Patchstack WordPress Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-30859

Indicators of Compromise

HTTP 301 or 302 responses from the WordPress site with Location headers pointing to external domains not associated with the site owner
Access log entries containing redirect parameters with URL-encoded external domains in requests targeting AliNext plugin endpoints
Referrer logs on downstream phishing infrastructure showing the vulnerable WordPress domain as the source

Detection Strategies

Inspect web server access logs for requests to AliNext plugin paths that include URL, redirect, or return parameters carrying absolute external URLs
Correlate outbound redirects from the WordPress site with threat intelligence feeds covering phishing and malicious domains
Alert on repeated redirect requests originating from the same IP address or user agent, which may indicate reconnaissance or campaign delivery

Monitoring Recommendations

Enable verbose logging on the WordPress reverse proxy or web application firewall to capture full request and response headers
Monitor the WordPress plugin directory for changes to installed versions of ali2woo-lite and flag versions at or below 3.5.1
Track user-reported phishing incidents that reference the WordPress domain to identify active exploitation

How to Mitigate CVE-2025-30859

Immediate Actions Required

Update the AliNext (ali2woo-lite) plugin to a version above 3.5.1 once the vendor releases a patched build
Audit the WordPress site for the presence of the vulnerable plugin using the plugin management console or the filesystem path wp-content/plugins/ali2woo-lite/
Review web server access logs for the past 90 days for evidence of exploitation attempts targeting redirect parameters

Patch Information

At the time of this writing, the Patchstack advisory lists all versions through 3.5.1 as affected. Administrators should monitor the plugin's WordPress.org listing and the vendor channels for a fixed release and apply the update as soon as it becomes available.

Workarounds

Deactivate and remove the AliNext plugin until a patched version is available if the plugin is not essential to site operations
Deploy a web application firewall rule that blocks requests to AliNext endpoints containing absolute URLs in redirect parameters
Configure the web server or reverse proxy to strip or rewrite Location headers pointing to domains outside an allowlist of trusted destinations

bash

# Example WAF rule concept to block external redirects on AliNext endpoints
# Adjust for your WAF syntax (ModSecurity example)
SecRule REQUEST_URI "@contains /wp-content/plugins/ali2woo-lite/" \
  "chain,deny,status:403,id:1030859,msg:'CVE-2025-30859 open redirect attempt'"
  SecRule ARGS "@rx ^https?://(?!yourdomain\.com)" \
    "t:none,t:urlDecodeUni"