CVE-2025-10740: WordPress URL Shortener Auth Bypass Flaw

CVE-2025-10740 Overview

CVE-2025-10740 affects the URL Shortener Plugin for WordPress in all versions up to and including 3.0.7. The plugin fails to enforce a capability check on the verifyRequest function exposed through its REST API. Authenticated users with Subscriber-level access or above can invoke the function and modify shortened links. The issue is classified under [CWE-89] in the National Vulnerability Database (NVD) record, though the primary weakness is broken access control on an API route. The Exploit Prediction Scoring System (EPSS) assigns a probability of 0.249%.

Critical Impact
Any authenticated WordPress user, including low-privilege Subscribers, can modify shortened URLs and redirect visitors to attacker-controlled destinations.

Affected Products

URL Shortener Plugin For WordPress — all versions through 3.0.7
WordPress sites permitting Subscriber-level registration
Sites exposing the plugin's exact-links REST API routes

Discovery Timeline

2025-10-24 - CVE-2025-10740 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10740

Vulnerability Analysis

The URL Shortener Plugin registers REST API routes under the exact-links namespace. One of these routes maps to the verifyRequest function, which handles link modification requests. The function does not call a current_user_can() check or an equivalent capability guard before performing state-changing operations.

WordPress treats any authenticated session, including a Subscriber account created through open registration, as valid for REST requests carrying a nonce. Because the plugin only verifies that the caller is authenticated, it grants Subscribers the same link-management authority as administrators. An attacker who registers a free account can send API requests that update the destination of any shortened link stored by the plugin.

Root Cause

The root cause is a missing authorization check in the verifyRequest handler declared in app/Http/Routes/api.php. The route relies on authentication as a proxy for authorization. WordPress's REST API requires plugins to declare a permission_callback that enforces required capabilities, and this route does not restrict access to users holding link-management privileges.

Attack Vector

Exploitation requires network access to the site and a valid low-privilege account. The attacker authenticates as a Subscriber, obtains a REST nonce from any authenticated page, and issues a POST request to the vulnerable exact-links endpoint with a modified target URL. The server updates the stored link record without a permission check. Subsequent visitors clicking the affected short link are redirected to the attacker-supplied destination, enabling phishing, malware delivery, or SEO abuse. See the Wordfence Vulnerability Information entry and the WordPress Plugin API Routes source for the route definition.

Detection Methods for CVE-2025-10740

Indicators of Compromise

Unexpected changes to short link destinations in the plugin's LinkAnalytics records or database tables.
REST API traffic to /wp-json/exact-links/ endpoints originating from Subscriber accounts.
Newly registered low-privilege user accounts that issue REST requests shortly after activation.

Detection Strategies

Review WordPress access logs for POST or PUT requests to the exact-links REST namespace from non-administrator sessions.
Compare current short link destinations against known-good backups to identify unauthorized modifications.
Enable plugin and database audit logging to record link updates with the acting user ID.

Monitoring Recommendations

Alert on REST API calls to the plugin's routes from users lacking manage_options or plugin-specific capabilities.
Track spikes in outbound redirects from short links to previously unseen domains.
Monitor user registration volume, especially when open registration is enabled with the Subscriber default role.

How to Mitigate CVE-2025-10740

Immediate Actions Required

Update the URL Shortener Plugin For WordPress to a version later than 3.0.7 once released by the vendor.
Audit all shortened links and restore any that were altered without authorization.
Disable open user registration or change the default new user role away from Subscriber until patched.

Patch Information

No fixed version is identified in the NVD record at the time of publication. Review the Wordfence Vulnerability Information advisory for updated patch status and the WordPress Link Analytics Model source for vendor commit activity.

Workarounds

Deactivate the URL Shortener Plugin For WordPress until a fixed release is available.
Restrict access to /wp-json/exact-links/ endpoints at the web server or web application firewall (WAF) layer to trusted IP ranges.
Remove existing Subscriber accounts that are not required for site operation.

bash

# Example nginx rule restricting the vulnerable REST namespace
location ~ ^/wp-json/exact-links/ {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;
}