Scheduled & Automatic Order Status Controller for WooCommerce <= 3.7.1 - Open Redirect
2025-03-27 00:00
Le Ngoc AnhStrategic Overview
StatusPatched in 3.7.2
Affected Version
<= 3.7.1CVSS7.2High
CVE
CVE-2025-30781Vulnerability Overview
The Scheduled & Automatic Order Status Controller for WooCommerce plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.7.1. This is due to insufficient validation on a redirect url. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Technical Analysis
REMEDIATION: Update to version 3.7.2, or a newer patched version --- IDENTIFIER: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')) The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C