PT-2025-43586 · WordPress · Url Shortener Plugin For Wordpress

Ifoundbug · CVE-2025-10740 · Published 2025-10-24 · Updated 2025-10-24

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions URL Shortener Plugin For WordPress versions through 3.0.7

Description The URL Shortener Plugin For WordPress plugin is susceptible to unauthorized access to API functionality. A missing capability check within the verifyRequest function allows authenticated attackers with Subscriber-level access or higher to modify links. The API endpoint is vulnerable due to this missing check. The vulnerable parameter is not specified.

Recommendations Update the URL Shortener Plugin For WordPress to a version later than 3.0.7.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10740

Affected Products

Url Shortener Plugin For Wordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10740 · Security Note
• https://plugins.trac.wordpress.org/browser/exact-links/trunk/app/Http/Routes/api.php · Note
• https://plugins.trac.wordpress.org/browser/exact-links/trunk/app/Models/LinkAnalytics.php?rev=3210852 · Note
• https://t.me/cveNotify/140136 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/29cc5016-005e-48e8-b929-5064798f24da?source=cve · Note
• https://t.me/CVEtracker/35644 · Telegram Post
• https://twitter.com/CVEnew/status/1981643773911138599 · Twitter Post