Open Redirect Vulnerability in Rustaurius Ultimate WP Mail Product by Rustaurius
CVE-2025-32694

4.7MEDIUM

Key Information:

Vendor

WordPress
Status
Ultimate WP Mail
Vendor
CVE Published:
9 April 2025

What is CVE-2025-32694?

The Rustaurius Ultimate WP Mail plugin for WordPress is prone to a URL Redirection to Untrusted Site vulnerability. This flaw allows attackers to exploit the plugin by redirecting users to malicious websites, facilitating phishing attacks. Affected versions of the plugin range from n/a to 1.3.2. Website administrators are urged to update to secure versions and review their site for potential exploitation.

Affected Version(s)

Ultimate WP Mail <= 1.3.2

References

https://patchstack.com/database/wordpress/plugin/ultimate...
vdb-entry

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Le Ngoc Anh (Patchstack Alliance)
.