404 Solution <= 4.3.5 - Unauthenticated Open Redirect via Regex Redirect Captures
- ID
- WPSEC-2026-0388
- Plugin
- 404 Solution (404-solution)
- Affected
- all versions before 4.3.6
- Remediation
- Update to 4.3.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-601
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- 404 Solution on WPSec AttackSurface
- Fix released
- Published
Description
The 404 Solution plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 4.3.5 due to insufficient validation of text captured from the requested URL when it is substituted into the `$N` placeholders of a regex redirect's destination. The plugin then allows the redirect to whatever host the resulting URL names, so a crafted path can change the redirect's host, for example by extending the configured host, turning it into userinfo, or forming a protocol-relative `//host` URL. This makes it possible for unauthenticated attackers to redirect users to arbitrary external sites if they can trick a user into clicking a crafted link. Exploitation requires a regex redirect whose destination places a capture group placeholder directly after (or inside) the destination host, or at the very start of a site-relative destination such as `/$1`.
References
- https://wpsec.com/vuln/WPSEC-2026-0388/
- https://plugins.svn.wordpress.org/404-solution/tags/4.3.6/
- https://wordpress.org/plugins/404-solution/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS