Open Redirect Vulnerability in Scheduled & Automatic Order Status Controller for WooCommerce
CVE-2025-30781

4.7MEDIUM

Key Information:

Vendor

WPfactory

Status
Scheduled & Automatic Order Status Controller For WooCommerce
Vendor
CVE Published:
27 March 2025

What is CVE-2025-30781?

A vulnerability in the Scheduled & Automatic Order Status Controller for WooCommerce allows an open redirect flaw, enabling attackers to redirect users to untrusted websites. This can be exploited for phishing attacks, where unsuspecting users may be directed to malicious sites under the guise of legitimate links. The flaw is present in versions of the plugin from n/a up to 3.7.1, posing a significant risk to website operators and their customers.

Affected Version(s)

Scheduled &amp; Automatic Order Status Controller for WooCommerce <= 3.7.1

References

https://patchstack.com/database/wordpress/plugin/order-st...
vdb-entry

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Le Ngoc Anh (Patchstack Alliance)
.