CVE-2025-30781: 
WordPress vulnerability analysis and mitigation

CVE-2025-30781 is an Open Redirect vulnerability discovered in WPFactory's Scheduled & Automatic Order Status Controller for WooCommerce plugin affecting versions through 3.7.1. The vulnerability was disclosed on March 27, 2025, and allows URL Redirection to Untrusted Sites that could enable phishing attacks (NVD, Patchstack).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site) with a CVSS v3.1 base score of 4.7 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. The issue stems from improper validation of redirect URLs, which could allow malicious actors to redirect users from legitimate sites to malicious ones (NVD, Patchstack).

The vulnerability could enable attackers to conduct phishing attacks by redirecting users from legitimate sites to malicious ones. This poses a risk of users being tricked into visiting seemingly legitimate sites only to be redirected to malicious destinations (Patchstack).

The vulnerability has been fixed in version 3.7.2 of the Scheduled & Automatic Order Status Controller for WooCommerce plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).