CVE-2026-6203 User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter
An attacker can craft a link that redirects users to malicious external sites after logout, facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-6203?
CVE-2026-6203 is a medium-severity vulnerability in wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder, published on 13 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5.1.4. This is due to insufficient validation of user-supplied URLs passed via the 'redirect_to_on_logout' GET parameter before redirecting users. The `redirect_to_on_logout` GET parameter is passed directly to WordPress's `wp_redirect()` function instead of the domain-restricted `wp_safe_redirect()`. While `esc_url_raw()` is applied to sanitize malformed URLs, it does not restrict the redirect destination to the local domain, allowing an attacker to craft a specially formed link that redirects users to potentially malicious external URLs after logout, which could be used to facilitate phishing attacks.
Weakness: CWE-601
Which versions are affected by CVE-2026-6203?
How do I fix CVE-2026-6203?
No fix has been published for CVE-2026-6203 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-6203 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6203 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-2vmw-qjp2-rr96.