Cross-Site Request Forgery Vulnerability in Short URL Plugin for WordPress

Summary

The Short URL plugin for WordPress possesses a vulnerability linked to inadequate nonce validation within the configuration_page function. This flaw allows unauthorized attackers to perform Cross-Site Request Forgery (CSRF) attacks. An attacker can exploit this weakness by luring a site administrator into clicking a manipulated link. Once successful, the attacker gains the ability to add or import redirects, including comments that may contain harmful cross-site scripting code, further compromising the security of the affected WordPress site.

References