CVE-2021-25074: 
WordPress vulnerability analysis and mitigation

The WebP Converter for Media WordPress plugin before version 4.0.3 contains an Unauthenticated Open Redirect vulnerability, identified as CVE-2021-25074. The vulnerability was discovered by Krzysztof Zając and publicly disclosed on December 27, 2021. This security issue affects all versions of the plugin prior to 4.0.3 (WPScan).

The vulnerability exists in the passthru.php file of the plugin, which fails to properly validate the 'src' parameter before performing user redirections. This security flaw is classified as CWE-601 and has been assigned a CVSS score of 4.3 (medium severity). The vulnerability falls under the OWASP Top 10 category A1: Injection (WPScan).

The vulnerability allows an unauthenticated attacker to perform open redirect attacks by manipulating the 'src' parameter. This could potentially be used to redirect users to malicious websites without requiring any authentication (CVE Mitre).

The vulnerability has been fixed in version 4.0.3 of the WebP Converter for Media plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).