PT-2026-20725 · WordPress+1 · Update Urls+1

0Xd4Rk5Id · Publicado 2026-02-19 · Atualizado 2026-02-19 · CVE-2026-25392

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions KaizenCoders Update URLs versions through 1.4.0

Description The Update URLs plugin for WordPress contains a flaw that allows for redirection to untrusted sites, potentially enabling phishing attacks. The issue resides in the way the plugin handles URLs, allowing malicious actors to manipulate them. The vulnerable component is Update URLs – Quick and Easy way to search old links and replace them with new links.

Recommendations Update to a version newer than 1.4.0.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-25392

Produtos afetados

Kaizencoders Update Urls

Update Urls

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-25392 · Nota de Segurança
• https://patchstack.com/database/Wordpress/Plugin/update-urls/vulnerability/wordpress-update-urls-quick-and-easy-way-to-search-old-links-and-replace-them-with-new-links-in-wordpress-plugin-1-3-0-open-redirection-vulnerability?_s_id=cve · Nota
• https://twitter.com/CVEnew/status/2024411360461816288 · Publicação no Twitter