CVE-2024-1849: 
WordPress vulnerability analysis and mitigation

The WP Customer Reviews WordPress plugin before version 3.7.1 contains a vulnerability that allows contributor-level users and above to redirect a page to a malicious URL. This vulnerability was discovered and reported on March 25, 2024, and was assigned CVE-2024-1849 (WPScan).

The vulnerability is classified as a Redirect type vulnerability with a CVSS score of 2.7 (low). It falls under the OWASP Top 10 category A1: Injection and is mapped to CWE-601. The vulnerability stems from improper parameter validation in the plugin, which can be exploited through the 'Business Name' field (WPScan).

When exploited, this vulnerability allows attackers with contributor-level access or higher to redirect users to malicious URLs, potentially leading to phishing attacks or other malicious activities (WPScan).

A proof of concept exists demonstrating the exploitation method: An attacker can create a new post and insert a specially crafted payload in the 'Business Name' field using the format: 0;http://smth.me/" HTTP-EQUIV="refresh" a="a). When the post is saved and viewed, it triggers the malicious redirect (WPScan).

The vulnerability has been patched in version 3.7.1 of the WP Customer Reviews plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).