{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/url-shortify--1.12.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kaizencoders:url_shortify:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":4.7,"id":"CVE-2026-1277"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["URL Shortify (\u003c 1.12.2)"],"_cs_severities":["low"],"_cs_tags":["wordpress","open-redirect","web-application","cve-2026-1277"],"_cs_type":"advisory","_cs_vendors":["KaizenCoders"],"content_html":"\u003cp\u003eCVE-2026-1277 is an unauthenticated open redirect vulnerability affecting the URL Shortify WordPress plugin (versions prior to 1.12.2). The vulnerability resides in the \u003ccode\u003ehandle_promotions\u003c/code\u003e method within \u003ccode\u003eurl-shortify/lite/includes/Promo.php\u003c/code\u003e. While the plugin sanitizes the \u003ccode\u003eredirect_to\u003c/code\u003e parameter using \u003ccode\u003eesc_url_raw()\u003c/code\u003e, it fails to validate the destination against a whitelist, enabling arbitrary redirection to external domains. A public proof-of-concept (PoC) exploit has been released, enabling attackers to generate malicious URLs that facilitate phishing campaigns by abusing trust in the target site.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious URL pointing to the site's \u003ccode\u003eadmin-ajax.php\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker injects a target phishing domain into the \u003ccode\u003eredirect_to\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eAttacker distributes the link to a victim via social engineering.\u003c/li\u003e\n\u003cli\u003eVictim clicks the malicious link while interacting with the legitimate WordPress site.\u003c/li\u003e\n\u003cli\u003eWordPress server processes the request and executes \u003ccode\u003ewp_redirect\u003c/code\u003e using the attacker-supplied parameter.\u003c/li\u003e\n\u003cli\u003eVictim is redirected to the attacker-controlled phishing site.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to abuse a trusted domain to redirect users to malicious, phishing, or malware-hosting sites. This vulnerability does not allow server-side compromise or unauthorized access to the underlying WordPress instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the URL Shortify plugin to version 1.12.2 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf an immediate update is not possible, deactivate the plugin until the patch can be applied.\u003c/li\u003e\n\u003cli\u003eImplement WAF rules to reject requests to \u003ccode\u003eadmin-ajax.php\u003c/code\u003e where the \u003ccode\u003eredirect_to\u003c/code\u003e parameter contains external hostnames that do not match an allow-list of your domain.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-27T18:15:41Z","date_published":"2026-10-27T18:15:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-url-shortify-open-redirect/","summary":"CVE-2026-1277 is an unauthenticated open redirect vulnerability in the URL Shortify WordPress plugin that allows attackers to redirect users to malicious websites via a crafted redirect_to parameter.","title":"KaizenCoders URL Shortify: Unauthenticated Open Redirect (CVE-2026-1277)","url":"https://feed.craftedsignal.io/briefs/2026-10-url-shortify-open-redirect/"}],"language":"en","title":"CraftedSignal Threat Feed - URL Shortify (\u003c 1.12.2)","version":"https://jsonfeed.org/version/1.1"}