PT-2025-43586 · WordPress · Url Shortener Plugin For Wordpress

Ifoundbug · Publicado 2025-10-24 · Atualizado 2025-10-24 · CVE-2025-10740

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions URL Shortener Plugin For WordPress versions through 3.0.7

Description The URL Shortener Plugin For WordPress plugin is susceptible to unauthorized access to API functionality. A missing capability check within the verifyRequest function allows authenticated attackers with Subscriber-level access or higher to modify links. The API endpoint is vulnerable due to this missing check. The vulnerable parameter is not specified.

Recommendations Update the URL Shortener Plugin For WordPress to a version later than 3.0.7.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-10740

Produtos afetados

Url Shortener Plugin For Wordpress

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10740 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/exact-links/trunk/app/Http/Routes/api.php · Nota
• https://plugins.trac.wordpress.org/browser/exact-links/trunk/app/Models/LinkAnalytics.php?rev=3210852 · Nota
• https://t.me/cveNotify/140136 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/29cc5016-005e-48e8-b929-5064798f24da?source=cve · Nota
• https://t.me/CVEtracker/35644 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1981643773911138599 · Publicação no Twitter