CVE-2026-1277

URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter

kaizencoders URL Shortify – Simple and Easy URL Shortener

CVSS

4.7Medium

ExploitationScanner template publicA Nuclei template detects it. Not in the KEV catalogNuclei

Exploit odds (EPSS)0.66%Chance of exploitation activity in the next 30 days, higher than 51% of CVEs. Scored 27 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version yet

Published18 Feb 2026Updated 8 Apr 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Timeline

18 Feb 2026, 04:35 UTCPublishedCVE List
27 Oct 2026, 13:53 UTCExploit code publicGitHub proof-of-concept repositories

Public exploit code and templates 1

Scanner templateURL Shortify <= 1.12.1 - Open RedirectNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Sadaqaty/CVE-2026-1277: The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. ThGitHub proof-of-concept repositories, 27 Oct 2026Exploit code

Description

The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.

Text from CVE List

Affected versions 1

URL Shortify – Simple and Easy URL Shorteneraffected: all versions through 1.12.1CVE List