CVE-2025-64250: Open Redirect in Directorist WordPress Plugin

An attacker can exploit this Open Redirect vulnerability to craft deceptive links that appear legitimate but redirect users to phishing sites designed to steal credentials or install malware. The attacker could embed these malicious links in emails, social media posts, or even on compromised websites. Successful redirection can lead to credential theft, malware infection, and further compromise of user accounts and systems. The blast radius extends to all users who interact with Directorist-powered websites and click on these crafted links, particularly if they trust the originating source.

1. Reserved2025-10-29
2. Published2025-12-16
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-64250 is to immediately upgrade the Directorist plugin to version 8.6.7 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter out redirect requests to suspicious domains. Carefully review and sanitize any user-supplied input used in redirect URLs to prevent malicious manipulation. Monitor web server logs for unusual redirect patterns that might indicate exploitation attempts.

Active installs

20KPopular

Plugin rating