CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
What the vulnerability does
The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.
Explanation of Vulnerability in Simple Terms
URL Shortify versions 1.12.1 and earlier contain an open redirect vulnerability. When a user clicks a malicious shortened URL, they are redirected to an attacker-controlled website. The vulnerability requires user interaction—the victim must click the link. No authentication is needed to exploit it.
What an attacker can do
Redirect users to a malicious website when they click a shortened URL.
Potential impact on your site
Users may be redirected to phishing or malware sites, damaging trust in your shortened URLs.
Conditions required to exploit
Victim must click a malicious shortened URL created by the attacker.
Key dates
External resources
