Cross-Site Request Forgery Vulnerability in WP URL Shortener Plugin by WordPress
CVE-2025-6064

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
WP Url Shortener
Vendor
CVE Published:
14 June 2025

What is CVE-2025-6064?

The WP URL Shortener plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) attacks due to inadequate nonce validation on the 'url_shortener_settings' page. This vulnerability allows attackers to exploit the plugin in all versions up to and including 1.2. By tricking an administrator into clicking a malicious link, unauthenticated users can alter settings and potentially inject harmful scripts, compromising the site's integrity.

Affected Version(s)

WP URL Shortener * <= 1.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-url-shorten...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Johannes Skamletz
.
CVE-2025-6064 : Cross-Site Request Forgery Vulnerability in WP URL Shortener Plugin by WordPress