Open Redirect Vulnerability in Automattic Newspack Newsletters
CVE-2025-49325

4.7MEDIUM

Key Information:

Vendor

WordPress
Status
Newspack Newsletters
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49325?

The URL Redirection vulnerability identified in Automattic's Newspack Newsletters allows attackers to redirect users to untrusted sites, facilitating phishing attacks. This flaw affects all versions of Newspack Newsletters up to and including version 3.13.0, posing a significant risk to user data and security. Website operators using this plugin are advised to implement immediate measures to mitigate such risks and ensure their user interactions remain secure.

Affected Version(s)

Newspack Newsletters <= 3.13.0

References

https://patchstack.com/database/wordpress/plugin/newspack...
vdb-entry

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hiro (Code016Hiro) (Patchstack Alliance)
.