CVE-2025-32694: Ultimate WP Mail Open Redirect Vulnerability

CVE-2025-32694 Overview

CVE-2025-32694 is an open redirect vulnerability in the Rustaurius Ultimate WP Mail plugin for WordPress. The flaw affects all versions up to and including 1.3.10. Attackers can craft URLs that appear to originate from a trusted WordPress site but redirect victims to attacker-controlled destinations. This behavior enables phishing campaigns that abuse the trust users place in the legitimate host domain. The weakness is classified under CWE-601, URL Redirection to Untrusted Site.

Critical Impact
Attackers can leverage the trusted WordPress domain to redirect authenticated or unauthenticated users to malicious sites, enabling credential theft and malware delivery through phishing.

Affected Products

Rustaurius Ultimate WP Mail plugin for WordPress
All versions from n/a through 1.3.10
WordPress sites with the ultimate-wp-mail plugin installed and active

Discovery Timeline

2025-04-09 - CVE-2025-32694 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32694

Vulnerability Analysis

The Ultimate WP Mail plugin fails to validate a user-supplied redirect parameter before issuing an HTTP redirect response. The plugin accepts an arbitrary URL and forwards the browser to that destination without confirming the target belongs to an allow-listed domain. Because the initial request originates from the legitimate WordPress host, security tools and end users treat the link as trusted. The vulnerability requires user interaction, such as clicking a crafted link, and does not require authentication. Successful exploitation supports phishing but does not directly compromise data confidentiality on the WordPress site itself.

Root Cause

The root cause is missing or insufficient validation of a redirect target parameter handled by the plugin. The application accepts external URLs and passes them to a redirect function without verifying scheme, host, or membership in an allow list. This maps directly to CWE-601.

Attack Vector

Exploitation occurs over the network. An attacker distributes a URL pointing to a vulnerable endpoint of the target WordPress site, appending a redirect parameter that references an attacker-controlled domain. When a victim clicks the link, the browser follows the initial request to the trusted site, then follows the plugin-issued redirect to the malicious destination. Attackers commonly pair this behavior with cloned login pages to harvest credentials. See the Patchstack Vulnerability Analysis for additional context.

Detection Methods for CVE-2025-32694

Indicators of Compromise

Outbound HTTP 30x responses from WordPress endpoints associated with the ultimate-wp-mail plugin that reference external hosts in the Location header.
Access log entries containing redirect query parameters (for example redirect=, url=, return=) with values pointing to domains outside the site's own host.
User reports of suspicious links that appear to originate from the affected WordPress domain but land on unfamiliar login or download pages.

Detection Strategies

Inventory WordPress installations and identify sites running the ultimate-wp-mail plugin at version 1.3.10 or earlier.
Review web server access logs for repeated requests to plugin endpoints containing URL-encoded external domains in redirect parameters.
Enable web application firewall (WAF) rules that flag redirect parameters resolving to hosts outside the site's registered domain.

Monitoring Recommendations

Alert on Location headers issued by WordPress that point to domains not on an internal allow list.
Monitor email gateway and proxy telemetry for user clicks on URLs referencing the affected WordPress hosts followed by navigation to newly registered external domains.
Track user-reported phishing incidents and correlate landing referrers against sites known to run the vulnerable plugin.

How to Mitigate CVE-2025-32694

Immediate Actions Required

Update the Ultimate WP Mail plugin to a version later than 1.3.10 once the vendor releases a fixed build.
Disable or remove the ultimate-wp-mail plugin on any site that cannot be patched immediately.
Notify users of the affected site to be cautious with links that appear to originate from the domain until remediation is complete.

Patch Information

Refer to the Patchstack Vulnerability Analysis for the current patch status and vendor-supplied fixed version. Apply the update through the WordPress plugin management interface or via WP-CLI once available.

Workarounds

Deploy a WAF rule that blocks requests to plugin endpoints when the redirect parameter references an external host.
Restrict access to plugin admin pages by IP allow list where feasible.
Configure the web server to rewrite or strip untrusted redirect parameters before they reach the plugin.

bash

# Example nginx snippet to block external redirect targets on a plugin endpoint
location ~* /wp-content/plugins/ultimate-wp-mail/ {
    if ($arg_redirect ~* "^https?://(?!yourdomain\.com)") {
        return 403;
    }
}