KaizenCoders URL Shortify: Unauthenticated Open Redirect (CVE-2026-1277)

CVE-2026-1277 is an unauthenticated open redirect vulnerability affecting the URL Shortify WordPress plugin (versions prior to 1.12.2). The vulnerability resides in the handle_promotions method within url-shortify/lite/includes/Promo.php. While the plugin sanitizes the redirect_to parameter using esc_url_raw(), it fails to validate the destination against a whitelist, enabling arbitrary redirection to external domains. A public proof-of-concept (PoC) exploit has been released, enabling attackers to generate malicious URLs that facilitate phishing campaigns by abusing trust in the target site.

Attack Chain

1. Attacker crafts a malicious URL pointing to the site's admin-ajax.php endpoint.
2. Attacker injects a target phishing domain into the redirect_to parameter.
3. Attacker distributes the link to a victim via social engineering.
4. Victim clicks the malicious link while interacting with the legitimate WordPress site.
5. WordPress server processes the request and executes wp_redirect using the attacker-supplied parameter.
6. Victim is redirected to the attacker-controlled phishing site.

Impact

Successful exploitation allows an attacker to abuse a trusted domain to redirect users to malicious, phishing, or malware-hosting sites. This vulnerability does not allow server-side compromise or unauthorized access to the underlying WordPress instance.

Recommendation

1. Upgrade the URL Shortify plugin to version 1.12.2 or later immediately.
2. If an immediate update is not possible, deactivate the plugin until the patch can be applied.
3. Implement WAF rules to reject requests to admin-ajax.php where the redirect_to parameter contains external hostnames that do not match an allow-list of your domain.