PT-2025-7711 · WordPress · Wpo365 | Microsoft 365 Graph Mailer
Krzysztof Zając
·
Published
2025-02-24
·
Updated
2025-03-27
·
CVE-2025-1488
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress versions up to and including 3.2
Description
The issue is related to insufficient validation on the redirect url supplied via the
redirect to parameter, making it possible for unauthenticated attackers to redirect users to potentially malicious sites. This can happen if attackers can trick users into performing an action and the plugin is activated but not configured.Recommendations
For versions up to and including 3.2, as a temporary workaround, consider restricting access to the
redirect to parameter to minimize the risk of exploitation. Avoid using the redirect to parameter in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wpo365 | Microsoft 365 Graph Mailer