Unauthorized Access in URL Shortener Plugin for WordPress

CVE-2025-10740

What is CVE-2025-10740?

The URL Shortener Plugin for WordPress has been identified as vulnerable due to a lack of necessary capability checks in the API's verifyRequest function. This flaw allows authenticated users with Subscriber-level access or higher to gain unauthorized access, enabling them to modify links without appropriate permissions. All versions up to and including 3.0.7 are affected, making it imperative for users to assess their installations and apply necessary updates or security measures.

References