WordPress: wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list

A vulnerability was discovered in the open redirect feature of a WordPress theme that serves a subdirectory site. The vulnerability was caused by incorrect use of a string replacement function where the fourth argument, intended to limit replacements to one occurrence, was actually interpreted as...