CVE-2026-88791 — Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules
The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allow…
Published: 2026-09-30 · CVSS: 3.4 · CVSS 3.1
The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7