Accept Donations with PayPal <= 1.5.2 - Open Redirect

mediumseverity

4.7CVSS score

0.5%likelihood of exploitation, next 30 days

43%of all CVEs are less likely

Readycheck to confirm it

The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.2. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

Impact

Attackers can redirect users to malicious sites, facilitating phishing attacks and credential theft.

Fix

Update to the latest version beyond 1.5.1.

How to confirm it

Send: GET {{BaseURL}}/?wpedon-stripe-checkout-redirect=1&sk=nucleitest&ai=nucleitest&si=nucleitest&rf=//oast.pro
Positive when: status 200 AND contains "src=\"https://js.stripe.com/v3/\"" AND contains "let rf = '//oast.pro" AND contains "window.location.href = rf;"

Run it with nuclei: nuclei -id CVE-2025-68602 -u <target>

The full check

id: CVE-2025-68602

info:
  name: Accept Donations with PayPal <= 1.5.2 - Open Redirect
  author: Shivam Kamboj
  severity: medium
  description: |
    The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.2. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
  impact: |
    Attackers can redirect users to malicious sites, facilitating phishing attacks and credential theft.
  remediation: |
    Update to the latest version beyond 1.5.1.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/easy-paypal-donation/accept-donations-with-paypal-152-unauthenticated-open-redirect
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68602
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
    cvss-score: 4.7
    cve-id: CVE-2025-68602
    epss-score: 0.0049
    epss-percentile: 0.42514
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2025,wordpress,wp,wp-plugin,redirect,easy-paypal-donation,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/?wpedon-stripe-checkout-redirect=1&sk=nucleitest&ai=nucleitest&si=nucleitest&rf=//oast.pro"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - 'src="https://js.stripe.com/v3/"'

      - type: word
        part: body
        words:
          - "let rf = '//oast.pro"

      - type: word
        part: body
        words:
          - "window.location.href = rf;"

    extractors:
      - type: regex
        name: open-redirect
        part: body
        regex:
          - "let rf = '([^']+)'"

References

Use this check only on systems you are authorised to test. Where the data comes from