PT-2026-20273 · WordPress · Url Shortify

Poystick + 1 · Published 2026-02-18 · Updated 2026-04-06 · CVE-2026-1277

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions URL Shortify plugin for WordPress versions prior to 1.12.2

Description The URL Shortify plugin for WordPress is susceptible to an Open Redirect issue in all versions up to and including 1.12.1. This is due to inadequate validation of the redirect to parameter within the promotional dismissal handler. An unauthenticated attacker can exploit this to redirect users to potentially malicious websites using a specially crafted link. The vulnerable parameter is redirect to.

Recommendations Update the URL Shortify plugin to version 1.12.2 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-1277

Affected Products

Url Shortify

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1277 · Security Note
• https://twitter.com/CVEarity/status/2024034311130005623 · Twitter Post
• https://twitter.com/CVEnew/status/2023995919646011617 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2033800539734217059 · Twitter Post
• https://t.me/cveNotify/152273 · Telegram Post
• https://plugins.trac.wordpress.org/browser/url-shortify/tags/1.11.4/lite/includes/Promo.php#L64 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c7c1dc51-47ca-4b2f-9ff9-275bd8b1c106?source=cve · Note
• https://twitter.com/aviatrixtrc/status/2041190993135816871 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3451740%40url-shortify&old=3445491%40url-shortify&sfp_email=&sfph_mail=#file1049 · Note