CVE-2026-1277
MEDIUM EXPLOITED NUCLEIWordPress URL Shortify <1.12.1 - Open Redirect
Title source: llmExploitation Summary
CVE-2026-1277 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Sechunt3r. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-1277, an unauthenticated open redirect vulnerability in the URL Shortify WordPress plugin (versions <= 1.12.1). The exploit leverages insufficient validation of the 'redirect_to' parameter in the promotional dismissal handler to redirect users to arbitrary URLs.
Description
The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.
Exploits (1)
This repository contains a functional exploit for CVE-2026-1277, an unauthenticated open redirect vulnerability in the URL Shortify WordPress plugin (versions <= 1.12.1). The exploit leverages insufficient validation of the 'redirect_to' parameter in the promotional dismissal handler to redirect users to arbitrary URLs.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N