CVE-2021-24210: 
WordPress vulnerability analysis and mitigation

The CVE-2021-24210 is an open redirect vulnerability discovered in the PhastPress WordPress plugin versions before 1.111. The vulnerability was disclosed on March 19, 2021, affecting websites using the vulnerable plugin versions. This security flaw allows attackers to malform requests to pages with the plugin installed and redirect victims to malicious websites (WPScan).

The vulnerability is classified as CWE-601 (Open Redirect) with a CVSS score of 4.3 (medium). The issue exists in the plugin's handling of redirect requests, where an attacker can manipulate the 'service' and 'src' parameters to redirect users to arbitrary domains. Despite previous claims that PHP requests were limited to whitelisted pages, it was demonstrated that redirects to any domain were possible (WPScan).

When exploited, this vulnerability allows attackers to redirect users from legitimate WordPress sites to potentially malicious websites. This can be particularly dangerous as users might trust the initial legitimate domain, making them more susceptible to phishing attacks or other malicious activities (WPScan).

The vulnerability can be exploited by crafting specific URLs targeting the PhastPress plugin's phast.php file. Example exploit paths include manipulating the 'service' and 'src' parameters through direct URL manipulation or using base64 encoded parameters (WPScan).

The vulnerability has been patched in PhastPress version 1.111. Website administrators using affected versions should immediately upgrade to version 1.111 or later to mitigate this security risk (WPScan).