CVE-2025-11167

CM Registration – Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open Redirect

4.7 Medium

The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.5.6. This is due to insufficient validation on the redirect url supplied via the 'redirect_url' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.21%Up 0.2 points since Oct 11, 2025

What each source reports

CVE List Score used 4.7

CM Registration – Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open Redirect

Record: CVE-2025-11167
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Weakness: CWE-601
Updated: 2026-11-02

EUVDEUVD-2025-33822 4.7

Record: EUVD-2025-33822
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-vv4r-w5cv-hm7v 4.7

The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin...

Record: GHSA-vv4r-w5cv-hm7v
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Weakness: CWE-601
Updated: 2026-11-02

NVD 4.7

Record: CVE-2025-11167
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Weakness: CWE-601
Updated: 2026-11-02

Affected products

creativemindssolutions cm registration – tailored tool for seamless login and invitation-based registrations

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-11167 is a medium vulnerability (CVSS 4.7) in Creativemindssolutions Cm Registration – Tailored Tool For Seamless Login And Invitation-based Registrations, published October 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. No source names a fixed version.