cbcvebase.
CVE-2026-1277
published 2026-02-18

CVE-2026-1277: The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the…

PriorityP275medium4.7CVSS 3.1
AVNACLPRNUIRSCCNILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
0.59%
43.9th percentile
The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.

Affected

1 ranges
VendorProductVersion rangeFixed in
kaizencodersurl_shortify_simple_and_easy_url_shortener<= 1.12.1—

Detection & IOCsextracted from sources · hover to see the quote

url/wp-admin/admin-ajax.php?action=heartbeat&kc_us_dismiss_admin_notice=1&option_name=bfcm_2025_offer&redirect_to=https://interact.sh↗
url/wp-admin/admin-ajax.php?action=heartbeat&kc_us_dismiss_admin_notice=1&option_name=welcome_offer&redirect_to=https://interact.sh↗
path/wp-admin/admin-ajax.php↗
  • →Detect exploit attempts by monitoring GET requests to /wp-admin/admin-ajax.php containing both 'kc_us_dismiss_admin_notice=1' and a 'redirect_to' parameter pointing to an external domain. ↗
  • →The vulnerability is exploitable by unauthenticated users; no session cookie or nonce is required. Alert on requests to admin-ajax.php with kc_us_dismiss_admin_notice=1 from unauthenticated sessions. ↗
  • →Two known option_name values used in exploitation: 'bfcm_2025_offer' and 'welcome_offer'. Use these as additional filter criteria alongside kc_us_dismiss_admin_notice=1. ↗
  • →Use the publicwww fingerprint query '/plugins/url-shortify/' to identify WordPress installations with the vulnerable plugin exposed. ↗
  • ·The vulnerability affects all versions up to and including 1.12.1 of the URL Shortify plugin. Versions beyond 1.12.1 are not confirmed vulnerable. ↗
  • ·The insufficient validation is specifically on the 'redirect_to' parameter within the promotional dismissal handler, not a general redirect mechanism in the plugin. ↗
  • ·The Nuclei template uses stop-at-first-match across two request variants; detection logic should account for either option_name value triggering the redirect. ↗

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
vulncheck4.7MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.