WordPress Core < 5.2.3 - Open Redirect

Reaching this weakness in WordPress 5.2 3.7 – 5.2.2 · 17 branches takes a caller who can reach the endpoint. An open redirect is a page that takes a destination from the request and sends the browser there without checking that the destination belongs to the site.

A link that starts on a trusted domain finishes on an attacker's, which is what makes phishing and consent-screen abuse credible to the person clicking it. For WordPress 5.2 the fix is 3.7.30: builds 3.7 – 5.2.2 · 17 branches are affected, anything from 3.7.30 onward is not.