CVE-2021-24406 wpForo Forum < 1.9.7 - Open Redirect
An attacker can redirect users to malicious sites after login, potentially stealing credentials through phishing replicas.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24406?
CVE-2021-24406 is a medium-severity vulnerability in gVectors Team wpForo Forum, published on 6 Jul 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimate one, asking them to re-enter their credentials (which will then in the attacker hands)
Weakness: CWE-601
Which versions are affected by CVE-2021-24406?
It affects 1 product.
Products include Gvectors Wpforo Forum.
How do I fix CVE-2021-24406?
No fix has been published for CVE-2021-24406 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24406 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24406 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in gVectors Team wpForo Forum
- CVE-2024-3200 wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection
- CVE-2022-40200 WordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerability
- CVE-2018-16613 Privilege escalation in n/a
- CVE-2026-28562 wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter
- CVE-2023-2249 Server-side request forgery in wpForo Forum
Sources
Also known as GHSA-pvwf-fqcf-wm8q.