The URL Shortify plugin for WordPress is vulnerable to an open redirect flaw present in all releases up to and including 1.12.1. The flaw stems from insufficient validation on the redirect_to parameter used in the promotional dismissal handler, allowing an attacker to craft a link that will cause any user who clicks it to be redirected to an arbitrary URL, which can be leveraged for phishing, drive‑by downloads, or other malicious activities. The vulnerability does not provide code execution or data exfiltration, but it can be used as a vector for social engineering attacks or to siphon traffic to attacker-controlled sites.

Any WordPress site that has installed the Kaizencoders URL Shortify plugin with version 1.12.1 or earlier is affected. The plugin versioning is listed up to 1.12.1, and the vulnerability resides in core code handling promotional banner dismissal.

The CVSS base score of 4.7 indicates a moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of mass exploitation for the time being. It is not referenced in CISA’s Known Exploited Vulnerabilities catalog, further indicating limited known use. Attackers can exploit this flaw by constructing a malicious URL that contains the unvalidated redirect_to parameter; a victim clicking the link will be redirected after dismissing the banner. No authentication or additional privileges are required.