PT-2025-21375 · WordPress · Payment Gateway For Telcell

Claudio Marchesini + 1 · Published 2025-05-15 · Updated 2025-06-11 · CVE-2023-6786

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: The Payment Gateway for Telcell WordPress plugin versions 2.0.1 and earlier

Description: The issue is related to an Open Redirect problem. It occurs because the api url parameter is not validated before the user is redirected to its value. This could potentially allow for malicious redirection.

Recommendations: For versions 2.0.1 and earlier, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the api url parameter to minimize the risk of exploitation.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2023-6786

Affected Products

Payment Gateway For Telcell

References · 6

• 🔥 https://wpscan.com/vulnerability/f3e64947-3138-4ec4-86c4-27b5d6a5c9c2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-6786 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6786 · Vendor Advisory
• https://t.me/cvenotify/125432 · Telegram Post
• https://twitter.com/CVEnew/status/1923119261385621560 · Twitter Post
• https://t.me/cvenotify/122736 · Telegram Post