Server-Side Request Forgery Vulnerability in URL Shortener by Md Yeasin Ul Haider
CVE-2025-28963

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Url Shortener
Vendor
CVE Published:
4 July 2025

What is CVE-2025-28963?

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the URL Shortener developed by Md Yeasin Ul Haider. This security flaw allows attackers to send crafted requests from the server, potentially leading to unauthorized access and exposure of sensitive information. The vulnerability affects all versions of the URL Shortener plugin up to 3.0.7, posing significant risks to the integrity of hosted services. Best practices for remediation should be implemented promptly to safeguard against possible exploitation.

Affected Version(s)

URL Shortener <= 3.0.7

References

https://patchstack.com/database/wordpress/plugin/exact-li...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ch4r0n (Patchstack Alliance)
.
CVE-2025-28963 : Server-Side Request Forgery Vulnerability in URL Shortener by Md Yeasin Ul Haider