CVE-2026-88791: Safe Redirect Manager Open Redirect Flaw

CVE-2026-88791 Overview

CVE-2026-88791 affects the Safe Redirect Manager WordPress plugin in versions prior to 2.3.0. The plugin fails to validate redirect destinations when administrators configure wildcard redirect rules pointing to absolute URLs. Unauthenticated attackers can craft request paths that redirect site visitors to arbitrary external domains. This open redirect flaw enables phishing campaigns, malware distribution, and reputation abuse by leveraging the trust associated with the vulnerable site.

Critical Impact
Unauthenticated attackers can weaponize legitimate WordPress sites to redirect users to attacker-controlled destinations, facilitating phishing and malware delivery.

Affected Products

Safe Redirect Manager WordPress plugin versions prior to 2.3.0
WordPress sites with wildcard redirect rules configured to absolute URLs
Any deployment relying on the plugin's redirect validation logic

Discovery Timeline

2026-09-30 - CVE CVE-2026-88791 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-88791

Vulnerability Analysis

The vulnerability is an open redirect flaw in the Safe Redirect Manager plugin's wildcard rule handling. When an administrator configures a wildcard redirect rule that targets an absolute URL, the plugin concatenates or substitutes portions of the incoming request path into the destination without validating that the resulting URL still points to the intended host. Attackers exploit this by crafting request paths that manipulate the final redirect target. The plugin then issues an HTTP redirect response pointing visitors to an attacker-chosen external domain.

Open redirects on WordPress sites are commonly abused in phishing kits because links appear to originate from a trusted domain. Users hovering over the URL see a legitimate domain, while the actual redirect lands on a credential-harvesting or malware-delivery page.

Root Cause

The root cause is missing destination validation in the wildcard rule processor. The plugin treats attacker-influenced path segments as trusted input when constructing the absolute redirect URL. No allowlist of destination hosts, canonicalization, or origin comparison is enforced before issuing the redirect response.

Attack Vector

Exploitation requires no authentication. An attacker only needs a WordPress site running a vulnerable Safe Redirect Manager version with at least one wildcard rule mapped to an absolute URL. The attacker crafts a URL on the target site with a specific request path that manipulates the wildcard substitution. Victims who click the URL, typically distributed via email, social media, or messaging, are silently redirected to the attacker's destination. See the WPScan Vulnerability Report for advisory details.

Detection Methods for CVE-2026-88791

Indicators of Compromise

HTTP 301 or 302 responses from the WordPress site referencing external domains not owned by the site operator
Web server access logs showing unusual request paths that trigger wildcard-matched redirects
Referrer telemetry from downstream phishing or malware sites pointing back to the affected WordPress domain

Detection Strategies

Audit installed plugins and flag Safe Redirect Manager versions below 2.3.0
Review all configured redirect rules for wildcard patterns paired with absolute URL destinations
Correlate outbound redirect responses against a known-good list of destination domains

Monitoring Recommendations

Enable verbose web server logging to capture full request URIs and response Location headers
Alert on spikes in 3xx responses that direct users to previously unseen external hosts
Monitor brand-abuse and phishing feeds for URLs referencing the WordPress domain as an intermediate hop

How to Mitigate CVE-2026-88791

Immediate Actions Required

Upgrade Safe Redirect Manager to version 2.3.0 or later on all WordPress installations
Inventory existing wildcard redirect rules and remove those that are no longer necessary
Review web server logs for prior exploitation attempts referencing crafted request paths

Patch Information

The issue is resolved in Safe Redirect Manager version 2.3.0. Site operators should update through the WordPress plugin dashboard or by deploying the updated plugin package. Consult the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Replace wildcard rules targeting absolute URLs with relative destinations that remain on the same origin
Remove wildcard redirect rules entirely until the plugin can be updated
Add a web application firewall rule that blocks outbound redirects to unapproved external hosts

bash

# Configuration example: update the plugin using WP-CLI
wp plugin update safe-redirect-manager --version=2.3.0
wp plugin list --name=safe-redirect-manager --fields=name,status,version