Open redirect in wp_validate_redirect() in WordPress

5.7 CVSS

Vulnerability Description

In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-4048

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from WordPress

View All →

CVE-2025-58674

WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability

Medium 5.9

CVE-2025-58246

WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

Medium 4.3

CVE-2025-54352

WordPress 3.5 through 6.8.2 allows remote attackers to guess titles...

Low 3.7

CVE-2024-31211

Remote Code Execution in `WP_HTML_Token`

Medium 5.5

CVE-2024-31210

PHP file upload bypass via Plugin installer

High 7.7

Affected Vendor

WordPress

View all reports →

Affected Software

wordpress-develop

Vulnerable Versions:

>= 5.4.0, < 5.4.2, >= 5.3.0, < 5.3.4, >= 5.2.0, < 5.2.7, >= 5.1.0, < 5.1.6, >= 5.0.0, < 5.0.10, >= 4.9.0, < 4.9.15, >= 4.8.0, < 4.8.14, >= 4.7.0, < 4.7.18, >= 4.6.0, < 4.6.19, >= 4.5.0, < 4.5.22, >= 4.4.0, < 4.4.23, >= 4.3.0, < 4.3.24, >= 4.2.0, < 4.2.28, >= 4.1.0, < 4.1.31, >= 4.0.0, < 4.0.31, >= 3.9.0, < 3.9.32, >= 3.8.0, < 3.8.34, >= 3.7.0, < 3.7.34