CVE-2025-39599: Listdom Open Redirect Vulnerability

CVE-2025-39599 Overview

CVE-2025-39599 is an open redirect vulnerability [CWE-601] in the Webilia Listdom plugin for WordPress. The flaw affects all versions up to and including 4.0.0. Attackers can craft URLs that appear to originate from a trusted Listdom-powered site but redirect victims to attacker-controlled destinations. This behavior enables phishing campaigns that abuse the trust of a legitimate domain to harvest credentials or deliver malware.

The issue requires user interaction and operates over the network without authentication. It carries a CVSS 3.1 base score of 4.7 and an EPSS probability of 0.374% (29.5 percentile) as of 2026-07-13.

Critical Impact
Attackers can leverage the trusted Listdom domain to redirect users to malicious sites, facilitating phishing and credential theft against site visitors.

Affected Products

Webilia Listdom WordPress plugin, versions up to and including 4.0.0
WordPress installations using the Listdom directory and listings plugin
Sites relying on Listdom for classified, business, or directory listings

Discovery Timeline

2025-04-16 - CVE-2025-39599 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39599

Vulnerability Analysis

The Listdom plugin accepts a redirection target from a user-controlled parameter without validating that the destination is internal or on an allow-listed host. When a victim clicks a link pointing to a vulnerable Listdom endpoint, the plugin issues an HTTP redirect to the attacker-supplied URL. Because the initial URL uses the legitimate site's domain, users and email security controls are more likely to trust it.

Open redirects rarely provide direct code execution or data disclosure on the host site. Their value to attackers lies in laundering phishing links through reputable domains, defeating URL reputation checks, and improving lure credibility in email or messaging campaigns.

Root Cause

The underlying weakness is improper validation of a redirect parameter, mapped to [CWE-601] URL Redirection to Untrusted Site. Listdom passes externally supplied input to a redirect function without enforcing a host allow list or restricting redirects to relative paths within the same origin.

Attack Vector

An attacker crafts a URL that includes a malicious redirect, url, or similar query parameter pointing to an external phishing site. The attacker distributes this URL via email, chat, or social media. When a victim clicks the link, the vulnerable Listdom endpoint returns an HTTP 3xx response sending the browser to the attacker's destination. No authentication is required, and no code is executed on the WordPress host itself.

Refer to the Patchstack Vulnerability Advisory for the technical write-up.

Detection Methods for CVE-2025-39599

Indicators of Compromise

Web server access logs showing Listdom URLs containing external URLs in query parameters such as redirect=, url=, return=, or next=.
HTTP 302 or 301 responses from Listdom endpoints with a Location header pointing to a non-owned domain.
Referer headers from phishing landing pages that identify the vulnerable WordPress site as the origin.

Detection Strategies

Parse WordPress and reverse-proxy logs for redirect parameters whose values decode to fully qualified external URLs.
Correlate outbound redirects from the site with domain reputation feeds to flag redirects to newly registered or low-reputation hosts.
Deploy web application firewall rules that inspect Listdom request parameters for http://, https://, and protocol-relative // prefixes.

Monitoring Recommendations

Alert on spikes in traffic to Listdom endpoints from external referrers, especially email link scanners or shortened URLs.
Monitor brand mentions and phishing feeds for URLs that abuse the site's domain as a redirection hop.
Track user reports of suspicious links purporting to originate from the affected WordPress site.

How to Mitigate CVE-2025-39599

Immediate Actions Required

Update the Listdom plugin to a version later than 4.0.0 once a patched release is available from Webilia.
Audit outbound redirects generated by Listdom in production logs to identify any active abuse.
Notify users and support staff to scrutinize links that pass through Listdom endpoints.

Patch Information

A vendor-supplied fixed version was not enumerated in the NVD entry at the time of writing. Consult the Patchstack Vulnerability Advisory and the Webilia plugin changelog for the current fixed release.

Workarounds

Deploy a WAF rule that blocks requests to Listdom URLs whose redirect parameters contain external hosts or protocol-relative paths.
Restrict the plugin's redirect functionality using a mu-plugin filter that rewrites redirects to relative paths on the site's own domain.
Temporarily disable Listdom features that rely on parameterized redirects if the plugin cannot be updated.

bash

# Example ModSecurity rule to block external redirects via Listdom parameters
SecRule REQUEST_URI "@rx (?i)/listdom" \
    "chain,phase:2,deny,status:403,id:1003959,\
    msg:'CVE-2025-39599 Listdom open redirect attempt'"
  SecRule ARGS:redirect|ARGS:url|ARGS:return|ARGS:next \
      "@rx ^(https?:)?//" "t:none,t:urlDecodeUni"