CVE-2025-64250

Executive Summary

CVE-2025-64250 is a URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the WordPress plugin Directorist by wpWax, affecting versions through 8.6.6. This vulnerability allows an attacker to craft a malicious link that, when clicked by a logged-in user, redirects them to an external, attacker-controlled domain. The primary risk is Phishing, as the redirect can be used to trick users into visiting fake login pages or downloading malware. The CVSS score is 4.7 (Medium), and no public exploit code or patch is currently available. The vulnerability is classified under MITRE ATT&CK tactic T1566 (Phishing).

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed Directorist from the WordPress dashboard or via direct download are at risk. No official patch has been released, making this a supply chain risk for any site using the plugin. Administrators should monitor the plugin's update channel and consider disabling the plugin until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.7 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - The victim must click a crafted link.
• Scope: Changed (S:C) - The redirect can lead to a different security domain.
• Confidentiality Impact: Low (C:L) - Potential for credential theft via phishing.
• Integrity Impact: Low (I:L) - The redirect can modify the user's perceived destination.
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the potential for phishing campaigns targeting site administrators or users makes this a significant concern for WordPress sites using Directorist.

Deep Dive & Mechanics

The vulnerability resides in the Directorist plugin's URL handling mechanism. The plugin likely accepts a redirect_to or similar parameter in a URL, which is then used to redirect the user after an action (e.g., login, form submission). The plugin fails to validate that the redirect URL belongs to the same origin (same site), allowing an attacker to supply an arbitrary external URL.

Attack Flow:

1. An attacker identifies a vulnerable endpoint in Directorist that performs a redirect based on a user-supplied parameter.
2. The attacker crafts a URL like: https://victim-site.com/directorist-page?redirect_to=https://evil.com/phishing-page
3. The attacker sends this link to a victim (e.g., via email, social media).
4. The victim, logged into the WordPress site, clicks the link.
5. The Directorist plugin processes the request and redirects the victim to https://evil.com/phishing-page.
6. The attacker's phishing page can then steal credentials or other sensitive information.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is hypothesized based on common open redirect vulnerabilities in WordPress plugins.

Vulnerable Code (Hypothetical):

// In a Directorist file (e.g., directorist/includes/class-redirect.php)
function directorist_redirect() {
    $redirect_url = $_GET['redirect_to'];
    if ( ! empty( $redirect_url ) ) {
        wp_redirect( $redirect_url );
        exit;
    }
}

Patched Code (Hypothetical):

function directorist_redirect() {
    $redirect_url = $_GET['redirect_to'];
    if ( ! empty( $redirect_url ) ) {
        // Validate that the URL is on the same site
        $parsed_url = wp_parse_url( $redirect_url );
        $site_url = wp_parse_url( home_url() );
        if ( $parsed_url['host'] === $site_url['host'] ) {
            wp_redirect( $redirect_url );
            exit;
        }
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Directorist plugin version <= 8.6.6.
• A publicly accessible attacker-controlled server (e.g., evil.com).

Exploitation Steps:

1. Identify the vulnerable redirect parameter. Common parameters include redirect_to, return, url, or next. Use a web proxy (e.g., Burp Suite) to intercept requests and look for redirects.
2. Craft the exploit URL:

   https://victim-site.com/directorist-login?redirect_to=https://evil.com/phishing
   

3. Send the link to the victim via email or social engineering.
4. When the victim clicks, they are redirected to evil.com, where you can host a fake login page.

Example Phishing Page (HTML):

<!DOCTYPE html>
<html>
<head><title>Login</title></head>
<body>
    <form action="https://victim-site.com/wp-login.php" method="post">
        <input type="text" name="log" placeholder="Username">
        <input type="password" name="pwd" placeholder="Password">
        <input type="submit" value="Login">
    </form>
</body>
</html>

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual redirect_to parameters pointing to external domains.
• Use a Web Application Firewall (WAF) to block requests with redirect_to containing external URLs.
• Implement Content Security Policy (CSP) headers to restrict redirect destinations.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri=*redirect_to=*
| rex field=uri "redirect_to=(?<redirect_url>[^&]+)"
| where redirect_url NOT LIKE "%victim-site.com%"
| table _time, clientip, uri, redirect_url

Indicators of Compromise (IOCs)

• URL Pattern: */directorist*?redirect_to=https://* (where the domain is not the legitimate site)
• Network Traffic: Outbound connections to known phishing domains after a redirect from the victim site.
• Log Entries: HTTP 302 responses with Location header pointing to an external domain.
• File Hashes: No specific file hashes; the vulnerability is in the plugin code itself.

Detection Engineering

YARA Rule

rule CVE_2025_64250_Open_Redirect {
    meta:
        description = "Detects Directorist plugin open redirect vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64250"
    strings:
        $redirect_func = "wp_redirect" nocase
        $redirect_param = "redirect_to" nocase
        $unsafe_redirect = /wp_redirect\s*\(\s*\$_GET\s*\[\s*['\"]redirect_to['\"]\s*\]\s*\)/ nocase
    condition:
        $unsafe_redirect or ($redirect_func and $redirect_param)
}

Sigma Rule

title: Directorist Open Redirect Detection
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-64250 in Directorist plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "redirect_to=http"
    condition: selection
falsepositives:
    - Legitimate redirects to external payment gateways (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64250 Directorist Open Redirect"; flow:to_server; content:"redirect_to=http"; http_uri; pcre:"/redirect_to=https?:\/\/[^\/]+\//Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Directorist plugin until an official patch is released.
2. Implement a WAF rule to block requests containing redirect_to with external URLs.
3. Monitor logs for suspicious redirect activity.

Long-term Fix:

• Apply the official patch from wpWax when available.
• Update to a patched version of Directorist (currently none).
• Consider replacing the plugin with an alternative if no patch is provided.

Workaround (Code-Level): If you have developer access, add a validation function to the plugin's redirect logic:

add_action( 'init', function() {
    if ( isset( $_GET['redirect_to'] ) ) {
        $redirect_url = $_GET['redirect_to'];
        $site_host = parse_url( home_url(), PHP_URL_HOST );
        $redirect_host = parse_url( $redirect_url, PHP_URL_HOST );
        if ( $redirect_host !== $site_host ) {
            wp_die( 'Invalid redirect URL.' );
        }
    }
});

Valters IT
Securing Digital Frontiers