CVE-2025-32693: 
WordPress vulnerability analysis and mitigation

URL Redirection to Untrusted Site ('Open Redirect') vulnerability affects WPWebinarSystem WebinarPress plugin versions through 1.33.27. The vulnerability was discovered and disclosed on April 9, 2025, and allows potential phishing attacks through malicious redirections (NVD, Patchstack).

The vulnerability is classified with a CVSS v3.1 Base Score of 4.7 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. The issue is tracked as CWE-601 (URL Redirection to Untrusted Site). The vulnerability stems from insufficient validation of redirect URLs, which can be exploited without authentication (NVD).

The vulnerability allows malicious actors to redirect users from legitimate sites to potentially malicious ones. This redirection capability could be leveraged in phishing attacks, where users might be tricked into visiting what they believe is a legitimate site before being redirected to a malicious one (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects WebinarPress versions through 1.33.27. Given the low severity impact, Patchstack indicates that virtual patching is unnecessary (Patchstack).