The URL Shortener Plugin for WordPress is missing a capability check on the verifyRequest function in the API, allowing authenticated users with subscriber-level access or higher to modify short links. This flaw can be exploited to redirect traffic to malicious sites or alter legitimate link destinations, potentially enabling phishing, defacement, or other link abuse. The vulnerability is a classic example of unauthorized access due to missing input validation, as identified in CWE-89.

Vendor rupok98 offers the URL Shortener Plugin for WordPress. Versions up to and including 3.0.7 are affected; all newer releases are presumed fixed.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests the exploitation probability is currently low. The vulnerability is not listed in CISA KEV, further implying limited widespread attacks. Based on the description, it is inferred that the attack requires an authenticated user with subscriber privileges and that the attack vector involves API requests to the plugin or use of the plugin interface; the attacker can manipulate short links.