CVE-2021-24749: URL Shortify < 1.5.1 - Arbitrary Link/Group Deletion via CSRF

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-29 · updated 2026-06-17
Weakness: CWE-352

Description

The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.

Affected products

URL Shortify: before 1.5.1 — fixed in 1.5.1

How to fix

Upgrade to a fixed version: URL Shortify 1.5.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/4b4e417d-0ae2-4c3c-81e6-4dcf39eb5697
https://wpscan.com/vulnerability/4b4e417d-0ae2-4c3c-81e6-4dcf39eb5697

Get alerted when CVE-2021-24749 or the next vulnerability affects your stack