WordPress Pie Register <3.8.2.3 - Open Redirect

mediumseverity

5.4CVSS score

24.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

WordPress Pie Register plugin before 3.8.2.3 contains an open redirect vulnerability. The plugin does not properly validate the redirection URL when logging in and login out. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

Authenticated attackers with low privileges can manipulate the redirect_to parameter during logout to redirect users to malicious sites for phishing attacks.

Fix

Fixed in version 3.8.2.3.

How to confirm it

Send: GET {{BaseURL}}/wp-admin?piereg_logout_url=true&redirect_to=https://oast.me
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)oast\.me.*$/

Run it with nuclei: nuclei -id CVE-2023-0552 -u <target>

The full check

id: CVE-2023-0552

info:
  name: WordPress Pie Register <3.8.2.3 - Open Redirect
  author: r3Y3r53
  severity: medium
  description: |
    WordPress Pie Register plugin before 3.8.2.3 contains an open redirect vulnerability. The plugin does not properly validate the redirection URL when logging in and login out. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    Authenticated attackers with low privileges can manipulate the redirect_to parameter during logout to redirect users to malicious sites for phishing attacks.
  remediation: |
    Fixed in version 3.8.2.3.
  reference:
    - https://wpscan.com/vulnerability/832c6155-a413-4641-849c-b98ba55e8551
    - https://nvd.nist.gov/vuln/detail/CVE-2023-0552
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-0552
    cwe-id: CWE-601
    epss-score: 0.24263
    epss-percentile: 0.97876
    cpe: cpe:2.3:a:genetechsolutions:pie_register:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: genetechsolutions
    product: pie_register
    framework: wordpress
  tags: cve2023,cve,redirect,pie,pie-register,wpscan,genetechsolutions,wordpress,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin?piereg_logout_url=true&redirect_to=https://oast.me"

    redirects: true
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)oast\.me.*$'

References

Use this check only on systems you are authorised to test. Where the data comes from