CVE-2025-68602: 
WordPress vulnerability analysis and mitigation

CVE-2025-68602 is an Open Redirect vulnerability (CWE-601) in the WordPress plugin "Accept Donations with PayPal & Stripe" (slug: easy-paypal-donation), developed by Scott Paterson. The flaw allows unauthenticated attackers to redirect users to arbitrary external URLs, enabling phishing attacks. All plugin versions up to and including 1.5.2 are affected; version 1.5.3 contains the fix. The vulnerability was reported on November 25, 2025, and publicly disclosed on December 25, 2025, with a CVSS v3.1 base score of 4.7 (Medium) (Patchstack, Red Hat CVE).

The root cause is insufficient validation of redirect URL parameters within the plugin, classified as CWE-601 (URL Redirection to Untrusted Site) and mapped to OWASP Top 10 A4: Insecure Design. An unauthenticated attacker can craft a malicious URL pointing to the vulnerable WordPress site that, when visited by a victim, silently redirects them to an attacker-controlled external site. Exploitation requires user interaction — the victim must click a crafted link — but no authentication or special privileges are needed on the attacker's side. A Nuclei detection template for this vulnerability was added to the ProjectDiscovery nuclei-templates repository in early 2025 (Patchstack, Nuclei Templates).

Successful exploitation allows an attacker to redirect users from a trusted WordPress site to a malicious external site, facilitating phishing campaigns, credential harvesting, or malware distribution. The confidentiality impact is low (users may be deceived into disclosing sensitive information on a spoofed site), while integrity and availability of the WordPress installation itself are not directly affected. Because the plugin is donation-focused and handles payment-related workflows (PayPal & Stripe), users redirected during a donation flow may be at elevated risk of financial fraud (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-68602. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that open redirect vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack). A Nuclei detection template was committed to the ProjectDiscovery repository, enabling automated scanning for vulnerable instances (Nuclei Templates).

1. Reconnaissance: Identify WordPress sites running the "Accept Donations with PayPal & Stripe" plugin (version ≤ 1.5.2) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:easy-paypal-donation).
2. Identify redirect parameter: Locate the plugin's redirect functionality — typically a URL parameter (e.g., ?redirect=) that is passed to a PHP redirect function without validation.
3. Craft malicious URL: Construct a URL pointing to the legitimate WordPress site with the redirect parameter set to an attacker-controlled domain (e.g., https://legitimate-site.com/?redirect=https://attacker.com/phishing).
4. Deliver to victim: Send the crafted URL to target users via email, social media, or other channels, leveraging the trusted domain's reputation to bypass suspicion.
5. Harvest credentials or deliver malware: When the victim clicks the link and is redirected to the attacker's site, present a spoofed donation or login page to capture credentials or payment information (Patchstack).

• Network: Outbound HTTP 302/301 redirect responses from the WordPress server to unexpected external domains, particularly originating from plugin-related endpoints.
• Logs: WordPress access logs showing requests to plugin URLs with suspicious redirect, url, or return parameters containing external domains; look for patterns like GET /?page=donation&redirect=http:// followed by external IPs.
• User Reports: End-user complaints about being unexpectedly redirected away from the donation page to unfamiliar sites after clicking a donation link.

The vendor has released version 1.5.3 of the "Accept Donations with PayPal & Stripe" plugin, which patches this vulnerability. Site administrators should update the plugin to version 1.5.3 or later immediately via the WordPress admin dashboard or by downloading from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No configuration-based workaround is available; updating is the only remediation (Patchstack).

The vulnerability was discovered and reported by security researcher "Legion Hunter" through Patchstack's vulnerability disclosure program on November 25, 2025, and published on December 25, 2025. Patchstack classified it as low priority with no impactful threat, noting it is unlikely to be exploited in targeted attacks but may appear in mass-scanning campaigns. Social media activity was minimal, with brief mentions on Bluesky and Mastodon/infosec.exchange following the Nuclei template additions in early 2025 (Patchstack).