Exploitation Research Plan - CVE-2026-1277 (URL Shortify)

1. Vulnerability Summary

The URL Shortify plugin (up to version 1.12.1) is vulnerable to an Unauthenticated Open Redirect. The flaw exists in the promotional notice dismissal handler, which processes a redirect_to parameter. Because the plugin uses the PHP wp_redirect() function instead of the security-focused wp_safe_redirect(), and fails to validate the destination host, an attacker can craft a link that redirects any user (including unauthenticated visitors) to an external malicious domain.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-post.php or /wp-admin/admin-ajax.php (typically handles notice dismissals).
• Hook: Likely admin_init or wp_ajax_nopriv_us_dismiss_promotional_notice.
• Vulnerable Parameter: redirect_to.
• Action Name: us_dismiss_promotional_notice (inferred from description) or us_dismiss_notice.
• Authentication: Unauthenticated.
• Preconditions: None. The handler is reachable by anyone hitting the admin initialization path.

3. Code Flow (Inferred from File Structure)

1. Entry Point: A user or automated script sends a GET request to /wp-admin/admin-post.php?action=us_dismiss_promotional_notice&redirect_to=https://evil.com.
2. Hook Execution: The WordPress admin_init hook fires. Even for unauthenticated users, admin-post.php triggers admin_init.
3. Handler Identification: The plugin's Admin class (likely in lite/includes/Admin.php) listens for the action parameter.
4. Processing:
   • The function dismiss_promotional_notice() (inferred) is called.
   • It retrieves the redirect_to parameter: $redirect = $_GET['redirect_to'];.
   • It might perform a nonce check, but if the wp_redirect($redirect) call occurs regardless of the nonce validation outcome, or if the nonce check is missing for unauthenticated "nopriv" contexts, the redirect proceeds.
5. Sink: The plugin calls wp_redirect($redirect). Since $redirect contains https://evil.com, the server issues a 302 Found response to the external site.

4. Nonce Acquisition Strategy

The vulnerability is described as Unauthenticated. In many cases involving promotional dismissals in WordPress:

• The nonce check might be entirely missing.
• The nonce check might use check_ajax_referer(..., ..., false) where the third parameter is false (don't die on failure), allowing the code to continue to the redirect.
• The wp_redirect() might be called in the "finally" block or outside the conditional that checks the nonce.

If a nonce is strictly required:

1. Shortcode: The plugin might expose nonces on the dashboard.
2. Variable: Check for window.kc_us_admin_obj?.nonce or similar in the dashboard.
3. Strategy: Since this is "Unauthenticated", we first attempt the exploit without a nonce. If it fails, we will search lite/includes/Admin.php for where the nonce is generated and attempt to find a public-facing page that enqueues it.

5. Exploitation Strategy

We will use the http_request tool to simulate a victim clicking a crafted link.

Step 1: Discover the exact Action Name

Since the source is a .pot file, we need to confirm the action string. We will use grep to find the handler in the lite/includes/Admin.php file.

grep -rn "add_action.*admin_init" lite/includes/Admin.php
grep -rn "add_action.*wp_ajax" lite/includes/Admin.php
grep -rn "redirect_to" lite/includes/Admin.php

Step 2: Execute Open Redirect

Assuming the action is us_dismiss_promotional_notice (based on plugin slug us and "promotional dismissal" description):

Request:

• Method: GET
• URL: http://localhost:8080/wp-admin/admin-post.php?action=us_dismiss_promotional_notice&redirect_to=https://www.google.com
• Headers: None required (Unauthenticated).

Expected Response:

• Status: 302 Found
• Header: Location: https://www.google.com

6. Test Data Setup

1. Install and activate URL Shortify version 1.12.1.
2. No specific users or posts are required because the vulnerability is unauthenticated.

7. Expected Results

• The HTTP response from the WordPress server must be a redirect (302).
• The Location header in the response must match the external URL provided in the redirect_to parameter.
• The exploitation agent should confirm that no validation was performed on the domain of the redirect_to value.

8. Verification Steps

1. HTTP Verification:
   Check the headers of the exploit request:

   # (Using the agent's internal state/logs from http_request)
   # Confirm: response.status === 302
   # Confirm: response.headers['location'] === 'https://www.google.com'
   

2. Code Verification:
   Inspect the patched version (1.12.2) vs the vulnerable version (1.12.1) to confirm wp_safe_redirect() was introduced.

   grep -r "wp_safe_redirect" .
   

9. Alternative Approaches

If admin-post.php does not work, the dismissal might be handled via admin-ajax.php.

• Alternative URL: http://localhost:8080/wp-admin/admin-ajax.php?action=us_dismiss_promotional_notice&redirect_to=https://www.google.com

If a different parameter name is used (e.g., url instead of redirect_to), we will search the source for wp_redirect calls:

grep -r "wp_redirect" lite/includes/

Then trace the variable used in that call back to its source (likely $_GET).