Vulnerability · Published Jul 6, 2021 · Assigned by WPScan

CVE-2021-24406wpForo Forum < 1.9.7 - Open Redirect

Medium 6.1

In plain English

A medium-severity open redirect in wpForo Forum from gVectors Team. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)2.9%top 12.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimate one, asking them to re-enter their credentials (which will then in the attacker hands)

Affected products (as reported)

Vendor	Product	Versions
gVectors Team	wpForo Forum	1.9.7 – before 1.9.7

Weakness: CWE-601

References

https://wpscan.com/vulnerability/a9284931-555b-4c96-86a3-09e1040b0388 x_refsource_CONFIRM