CVE-2024-8761: Share This Image Open Redirect Vulnerability

CVE-2024-8761 Overview

CVE-2024-8761 is an open redirect vulnerability in the Share This Image plugin for WordPress. The flaw affects all versions up to and including 2.03. It stems from insufficient validation of the redirect URL supplied through the link parameter in the plugin's shortlink handler. Unauthenticated attackers can craft URLs that redirect visitors from a trusted WordPress site to attacker-controlled destinations. This category of weakness is tracked as CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Attackers can leverage the trust of the hosting WordPress domain to redirect users to phishing pages, malware droppers, or credential-harvesting sites without requiring authentication.

Affected Products

Share This Image plugin for WordPress (wp-unit/share_this_image)
All versions up to and including 2.03
WordPress sites with the plugin active and reachable over the network

Discovery Timeline

2024-09-17 - CVE-2024-8761 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8761

Vulnerability Analysis

The Share This Image plugin exposes a shortlink handler that reads the link parameter and issues an HTTP redirect to the supplied value. The handler does not verify that the destination belongs to the site's own origin or matches an allowlist of trusted domains. Because the redirect is initiated by the WordPress host, victims see a legitimate domain in the initial URL before being sent to an arbitrary external location. The redirect requires user interaction, typically a click on a crafted link delivered through email, chat, or social media. The scope is changed because the redirect crosses the trust boundary of the originating site.

Root Cause

The root cause is missing validation on user-supplied input used in an HTTP redirect. The shortlink logic in includes/class-sti-shortlink.php accepts the link query parameter and passes it to the redirect response without host verification, scheme filtering, or allowlist checks. See the vendor changeset in WordPress Changeset #3152564 for the corrective diff and the pre-patch source in the WordPress STI Shortlink Class.

Attack Vector

An unauthenticated attacker constructs a URL on the vulnerable WordPress site that includes an attacker-controlled value in the link parameter. The attacker distributes the URL through phishing emails, messaging platforms, or malicious ads. When a victim clicks the link, the plugin issues a redirect to the attacker's destination, delivering phishing content or drive-by download payloads. The technical details of the vulnerable code path are documented in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-8761

Indicators of Compromise

HTTP access log entries containing the plugin's shortlink endpoint with external URLs in the link query parameter
Requests to the WordPress site returning 3xx responses with Location headers pointing to unrelated domains
Referrer telemetry from downstream domains showing traffic originating from the vulnerable WordPress site

Detection Strategies

Inspect WordPress and reverse-proxy access logs for the shortlink handler paths with off-site values in link
Alert on 302/301 responses from the WordPress origin whose Location header host differs from the site's own domain
Correlate outbound clicks reported by email security or web proxies with the WordPress domain acting as the redirector

Monitoring Recommendations

Baseline the destinations legitimately produced by the Share This Image plugin and flag deviations
Enable web application firewall (WAF) logging for query-string parameters commonly abused for open redirects, including link, url, redirect, and next
Track plugin version inventory across WordPress deployments to identify hosts still running 2.03 or earlier

How to Mitigate CVE-2024-8761

Immediate Actions Required

Update the Share This Image plugin to a version newer than 2.03 that contains the fix from WordPress Changeset #3152564
Audit WordPress plugin inventory and remove Share This Image from sites that do not require it
Review recent access logs for suspicious use of the shortlink endpoint and notify affected users if phishing redirects were served

Patch Information

The vendor addressed the issue in the plugin repository. The corrective commit is available at WordPress Changeset #3152564. Update instructions and release notes are published on the plugin page at WordPress Plugin Developer Info. Administrators should apply the update through the WordPress admin console or via WP-CLI.

Workarounds

Deactivate and delete the Share This Image plugin until the patched version can be installed
Add a WAF rule that blocks requests to the plugin's shortlink handler whose link parameter contains external hostnames or absolute URLs
Restrict outbound redirects at the reverse proxy by rewriting Location headers that reference domains outside an approved allowlist

bash

# Example ModSecurity rule blocking external values in the link parameter
SecRule ARGS:link "@rx ^(https?:)?//(?!(www\.)?example\.com/)" \
  "id:1008761,phase:2,deny,status:403,\
   msg:'CVE-2024-8761: Share This Image open redirect attempt',\
   tag:'CWE-601'"