CVE-2026-6203: 
WordPress vulnerability analysis and mitigation

CVE-2026-6203 is an Open Redirect vulnerability in the User Registration & Membership plugin for WordPress, affecting versions up to and including 5.1.4. The flaw allows unauthenticated attackers to redirect users to arbitrary external URLs upon logout by manipulating the redirect_to_on_logout GET parameter. It was published on April 13, 2026, with a patch advisory added to the GitHub Advisory Database on April 14, 2026. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-601 (URL Redirection to Untrusted Site), stemming from the plugin passing the redirect_to_on_logout GET parameter directly to WordPress's wp_redirect() function rather than the domain-restricted wp_safe_redirect(). While esc_url_raw() is applied to sanitize malformed URLs, it only ensures the URL is well-formed and does not restrict the destination to the local domain. This means an attacker can supply any external URL as the redirect target, which will be followed after a user logs out. The vulnerable code is visible in the plugin's functions-ur-template.php file at line 39 (GitHub Advisory, Plugin Source).

Successful exploitation enables attackers to redirect authenticated WordPress users to attacker-controlled external domains immediately after logout, without any restriction. This can be leveraged for phishing attacks — for example, redirecting users to convincing fake login pages that harvest credentials. There is no direct impact on availability, and confidentiality and integrity impacts are rated low, as the vulnerability itself does not grant access to site data but facilitates social engineering attacks against users (GitHub Advisory, Wordfence).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.884% (76th percentile), indicating a moderate relative probability of exploitation within 30 days. Exploitation requires user interaction — a victim must click a crafted link and complete the logout flow — but requires no authentication or special privileges from the attacker. A Nuclei detection template has been added to the ProjectDiscovery nuclei-templates repository, enabling automated scanning for vulnerable instances (GitHub Advisory, Nuclei Templates).

1. Reconnaissance: Identify WordPress sites running the User Registration & Membership plugin version 5.1.4 or earlier using tools like WPScan, Shodan, or the ProjectDiscovery Nuclei template for CVE-2026-6203.
2. Craft malicious URL: Construct a logout URL targeting the vulnerable site that includes the redirect_to_on_logout GET parameter pointing to an attacker-controlled domain, e.g., https://victim-site.com/wp-login.php?action=logout&redirect_to_on_logout=https://attacker-phishing-site.com.
3. Deliver to target: Send the crafted URL to a target user via email, social media, or other phishing channels, disguising it as a legitimate site link (e.g., a "click here to log out securely" message).
4. User clicks and logs out: When the victim clicks the link and is logged out of the WordPress site, the plugin passes the attacker-supplied URL to wp_redirect(), redirecting the user's browser to the malicious external domain.
5. Phishing/credential harvesting: The attacker's external site presents a convincing fake login page mimicking the legitimate WordPress site, capturing the victim's credentials upon re-entry (GitHub Advisory, Wordfence).

• Network: Outbound HTTP 302 redirect responses from the WordPress server to external domains following logout requests; unusual referrer headers from external domains in subsequent web server logs.
• Logs: Web server access logs showing GET requests to /wp-login.php?action=logout with a redirect_to_on_logout parameter containing an external (non-local) domain URL; repeated requests with varying external URLs in the redirect_to_on_logout parameter may indicate automated scanning.
• Application Logs: WordPress debug logs or plugin logs showing wp_redirect() calls with external URLs originating from the redirect_to_on_logout parameter.
• User Reports: End users reporting being redirected to unfamiliar or suspicious external pages after logging out of the WordPress site (Wordfence).

Users should update the User Registration & Membership plugin to a version newer than 5.1.4, which replaces the insecure wp_redirect() call with the domain-restricted wp_safe_redirect(). As a temporary workaround, administrators can implement Web Application Firewall (WAF) rules to detect and block requests where the redirect_to_on_logout parameter contains external domain references. Additionally, reviewing web server and access logs for suspicious redirect_to_on_logout parameter usage is recommended to identify any attempted exploitation (GitHub Advisory, Wordfence).

Wordfence reported the vulnerability as part of their weekly WordPress vulnerability report for April 13–19, 2026, and included it in their threat intelligence database (Wordfence Blog). Sucuri also referenced the vulnerability in their April 2026 vulnerability patch roundup (Sucuri Blog). The ProjectDiscovery team added a Nuclei detection template for automated scanning, reflecting community interest in identifying vulnerable installations (Nuclei Templates). Overall community reaction is measured, consistent with the moderate severity rating and absence of active exploitation.