CVE-2021-24749

CVE-2021-24749 affects the WordPress URL Shortify plugin, where versions prior to 1.5.1 lack CSRF protection for bulk deletion of links or groups. This could allow a logged-in admin to delete arbitrary links/groups via CSRF. The issue is confirmed across multiple sources in the connected document...

URL Shortify < 1.5.1 - Arbitrary Link/Group Deletion via CSRF

The plugin does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack. PoC https://example.com/wp-admin/admin.php?page=uslinks=bulkdeleteids=1...

URL Shortify < 1.5.1 - Arbitrary Link/Group Deletion via CSRF

The plugin does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack. https://example.com/wp-admin/admin.php?page=uslinks&action=bulkdelete&linkids=1...

WordPress URL Shortify plugin <= 1.5.0 - Arbitrary Link/Group Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Link/Group Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by apple502j in WordPress URL Shortify plugin versions = 1.5.0. Solution Update the WordPress URL Shortify plugin to the latest available version at least 1.5.1...