{"id":"CVE-2026-1296","aliases":["EUVD-2026-7927","GHSA-cpmc-9298-xjhp"],"status":"published","title":"Frontend Post Submission Manager Lite \u003c= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter","description":"The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00515,"percentile":0.44227,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-601"],"published":"2026-02-18T04:35:43Z","modified":"2026-06-17T10:15:28Z","exploits":[{"source":"nuclei","id":"CVE-2026-1296","title":"Frontend Post Submission Manager Lite \u003c= 1.2.7 - Open Redirect","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1296.yaml"},{"source":"pocgithub","id":"Sadaqaty/CVE-2026-1296","title":"Sadaqaty/CVE-2026-1296","date":"2026-10-27","url":"https://github.com/Sadaqaty/CVE-2026-1296"}],"products":[{"vendor":"wpshuffle","product":"frontend post submission manager lite – frontend posting wordpress plugin"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c52129-7cf5-4a1b-80a1-b01140e6a72b?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/trunk/includes/classes/class-fpsml-shortcode.php#L108"},{"url":"https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.2.6/includes/classes/class-fpsml-shortcode.php#L108"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3458652%40frontend-post-submission-manager-lite\u0026new=3458652%40frontend-post-submission-manager-lite\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1296"},{"url":"https://github.com/advisories/GHSA-cpmc-9298-xjhp"}],"sources":{"cve":[{"id":"CVE-2026-1296","title":"Frontend Post Submission Manager Lite \u003c= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter","description":"The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.","status":"published","published":"2026-02-18T04:35:43.878Z","modified":"2026-02-18T20:47:37.114Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:20:01.618694Z"}],"euvd":[{"id":"EUVD-2026-7927","description":"The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.","status":"published","published":"2026-02-18T04:35:43Z","modified":"2026-02-18T20:47:37Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:37.43406Z"}],"ghsa":[{"id":"GHSA-cpmc-9298-xjhp","title":"The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection...","description":"The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.","status":"published","published":"2026-02-18T06:30:19Z","modified":"2026-02-18T06:30:25Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:06:14.396911Z"}],"nvd":[{"id":"CVE-2026-1296","description":"The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.","status":"published","published":"2026-02-18T05:16:25.49Z","modified":"2026-06-17T10:15:28.33Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:12:06.274729Z"}]}}