Lucene search
Brandon RoldanWPVDB-ID:562E81AD-7422-4437-A5B4-FCAB9379DB82HistoryDec 20, 2021 - 12:00 a.m.
AnyComment <= 0.3.1 - Open Redirect
2021-12-2000:00:00
Brandon Roldan
wpscan.com
5
0.001 Low
EPSS
Percentile
43.6%
The plugin has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.
PoC
https://example.com/wp-json/anycomment/v1/auth/wordpress?redirect=https://wpscan.com
| CPE | Name | Operator | Version |
|---|---|---|---|
| anycomment | eq | * |
Related
cve
cve
CVE-2021-24838
2022-01-17 13:15:07
patchstack
patchstack
WordPress AnyComment plugin <= 0.3.4 - Open Redirect vulnerability
2021-12-20 00:00:00
prion
prion
Open redirect
2022-01-17 13:15:00
cvelist
cvelist
CVE-2021-24838 AnyComment < 0.3.5 - Open Redirect
2022-01-17 13:00:27
nuclei
nuclei
WordPress AnyComment <0.3.5 - Open Redirect
2022-01-25 11:44:00
nvd
nvd
CVE-2021-24838
2022-01-17 13:15:07
wpexploit
wpexploit
AnyComment <= 0.3.1 - Open Redirect
2021-12-20 00:00:00