CVE-2025-49325: Newspack Newsletters Open Redirect Flaw

CVE-2025-49325 Overview

CVE-2025-49325 is an open redirect vulnerability in the Automattic Newspack Newsletters plugin for WordPress. The flaw is classified as URL Redirection to Untrusted Site [CWE-601] and affects all versions of newspack-newsletters up to and including 3.13.0. Attackers can craft URLs that appear to originate from a trusted WordPress site but redirect victims to attacker-controlled destinations. This behavior enables phishing campaigns that abuse the legitimate domain to bypass user suspicion and email security filters.

Critical Impact
Attackers can leverage the trusted domain of a WordPress site running Newspack Newsletters to redirect users to malicious pages, facilitating credential harvesting and malware delivery through phishing.

Affected Products

Automattic Newspack Newsletters plugin for WordPress
All versions from initial release through 3.13.0
WordPress sites using the newspack-newsletters plugin for email campaigns

Discovery Timeline

2025-06-06 - CVE-2025-49325 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49325

Vulnerability Analysis

The vulnerability stems from insufficient validation of user-supplied URL parameters used in redirect logic within the Newspack Newsletters plugin. The plugin accepts a destination URL and issues an HTTP redirect without verifying that the target belongs to an allow-listed domain or matches the site origin. This allows an attacker to append or manipulate a redirect parameter so that a request to the trusted WordPress host forwards the browser to an arbitrary external site.

Because the initial URL points to a legitimate domain, the attack can defeat visual inspection by end users and evade URL-reputation checks that trust the base domain. The vulnerability requires user interaction, since the victim must click the crafted link, but no authentication is needed to construct or distribute it.

Root Cause

The root cause is missing or inadequate validation on a redirect parameter, mapping directly to [CWE-601]: URL Redirection to Untrusted Site. The plugin does not restrict redirect targets to an allow list of trusted hosts and does not enforce same-origin checks before issuing the redirect response.

Attack Vector

An attacker constructs a link pointing to a vulnerable Newspack Newsletters endpoint on a targeted WordPress site, with a redirect parameter set to an attacker-controlled URL. The attacker distributes the link through email, social media, or messaging platforms. When the victim clicks, the WordPress site issues a redirect to the malicious destination, which typically hosts a phishing page mimicking the trusted brand. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-49325

Indicators of Compromise

Web server access logs showing requests to Newspack Newsletters endpoints with external URLs in redirect-related query parameters
HTTP 301 or 302 responses from the WordPress site with Location headers pointing to unrelated external domains
Inbound email or referral traffic containing crafted links to the vulnerable plugin endpoints followed by external redirect targets

Detection Strategies

Parse WordPress access logs for query parameters containing full external URLs, especially those combined with the plugin's request paths
Correlate outbound redirect responses with destination domains not on an approved allow list
Monitor email gateways for messages containing links that use the site domain as a redirector to unrelated hosts

Monitoring Recommendations

Enable verbose logging on the WordPress web server and forward logs to a centralized SIEM for query-parameter analysis
Add detection content that flags redirect responses where the Location header host differs from the request host
Track user-reported phishing incidents that reference links appearing to originate from the WordPress site

How to Mitigate CVE-2025-49325

Immediate Actions Required

Identify all WordPress installations running the newspack-newsletters plugin at version 3.13.0 or earlier
Upgrade the plugin to a version above 3.13.0 once released by Automattic
Notify users and subscribers about active phishing risk if the plugin cannot be immediately patched

Patch Information

Automattic addresses the open redirect in versions released after 3.13.0. Administrators should consult the Patchstack Vulnerability Report and the plugin changelog to confirm the fixed release before upgrading.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests to Newspack Newsletters endpoints containing external URLs in redirect parameters
Restrict redirect destinations at the reverse proxy layer to the site's own domain until the plugin is upgraded
Temporarily disable the newspack-newsletters plugin on sites that do not require active newsletter functionality

bash

# Example nginx rule to block external redirect targets on Newspack endpoints
location ~ /wp-content/plugins/newspack-newsletters/ {
    if ($arg_redirect_to ~* "^https?://(?!yoursite\.com)") {
        return 403;
    }
}