CVE-2024-3597: 
WordPress vulnerability analysis and mitigation

The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to Open Redirect (CVE-2024-3597) in all versions up to, and including, 2.2.2. The vulnerability was discovered and reported by Wordfence (Wordfence Advisory).

The vulnerability stems from insufficient validation on the redirect URL supplied via the rc_exported_zip_file parameter. The severity is rated as MEDIUM with a CVSS v3.1 base score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) according to NVD, while Wordfence rates it as HIGH with a score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) (NVD Database).

This vulnerability allows unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. The impact includes potential phishing attacks and malicious redirections (NVD Database).

The vulnerability can be exploited by unauthenticated attackers who can craft specific URLs to perform malicious redirects. User interaction is required for successful exploitation (NVD Database).

Users should update the Export WP Page to Static HTML/CSS plugin to a version newer than 2.2.2 as soon as possible. If immediate updating is not possible, consider disabling the plugin until an update can be applied (NVD Database).