CVE-2026-88791 in Safe Redirect Manager Plugin
Summary
by MITRE • 09/30/2026
The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in Safe Redirect Manager versions prior to 2.3.0 represents a critical security flaw within WordPress plugin architecture, specifically concerning the handling of wildcard redirect rules that target absolute URLs. This issue stems from insufficient input validation and sanitization mechanisms when processing HTTP requests against configured redirection patterns. The core technical failure lies in the application's inability to properly distinguish between legitimate internal routing paths and maliciously crafted external targets during the evaluation of wildcard matchers. When an administrator configures a redirect rule using a wildcard pattern directed at an absolute URL, the plugin fails to enforce strict boundary checks on the incoming request URI relative to that destination. This oversight allows unauthenticated attackers to exploit the logic by constructing specific request paths that trigger the redirection mechanism toward arbitrary external domains controlled by the attacker.
From a technical perspective, this flaw is classified under CWE-601, which denotes URL Redirection to Untrusted Site via User-supplied URL Parameter, although in this context it manifests through path manipulation rather than direct parameter injection into a query string. The vulnerability leverages the flexibility of wildcard matching features common in redirect management plugins but fails to implement necessary allow-listing or domain validation checks before executing the HTTP 3xx response code that performs the actual redirection. By crafting a request path that matches the defined wildcard pattern, an attacker can bypass standard security controls because the plugin trusts the configuration context without verifying if the resulting destination is safe or intended for public access. This lack of contextual verification creates a direct pathway for abuse by any user with internet access to the vulnerable WordPress instance.
The operational impact of this vulnerability extends beyond simple link redirection and poses significant risks related to phishing, malware distribution, and reputation damage. Attackers can utilize this flaw to redirect legitimate users from trusted domains to malicious sites that mimic login pages or distribute harmful software, thereby facilitating credential theft or system compromise for end-users. For the organization hosting the WordPress site, such redirects severely undermine trust in their digital presence and may result in search engine penalties due to association with known bad actors. Furthermore, because the attack requires no authentication, it is easily scalable and can be automated using simple scripts that iterate through potential wildcard patterns or exploit existing configurations without needing prior access credentials.
Mitigation strategies must focus on immediate remediation of the software version alongside enhanced configuration practices. The primary solution involves upgrading Safe Redirect Manager to version 2.3.0 or later, where developers have addressed these validation gaps by implementing stricter checks on redirect destinations and ensuring that wildcard rules do not permit redirection to arbitrary external domains unless explicitly whitelisted. In environments where immediate patching is not feasible, administrators should review existing redirect configurations to remove any wildcard rules pointing to absolute URLs of untrusted origins. Additionally, deploying a Web Application Firewall with robust rule sets capable of detecting anomalous redirect patterns can provide an additional layer of defense by blocking requests that attempt to exploit this specific logic flaw before they reach the application layer.
This incident highlights broader implications for web application security regarding how dynamic routing and redirection features are implemented within content management systems. It aligns with ATT&CK technique T1566, specifically sub-technique T1566.002 which involves Spearphishing Link attacks, as the vulnerability enables attackers to disguise malicious links behind trusted domains through forced redirects. Security professionals must recognize that even seemingly benign configuration options like wildcard redirection can introduce severe risks if not properly constrained by input validation and output encoding standards. Regular audits of plugin configurations and adherence to secure coding principles are essential to prevent similar vulnerabilities in future updates or alternative plugins managing URL routing within WordPress ecosystems.