The URL Shortify – Simple and Easy URL Shortener WordPress plugin versions up to 1.12.1 contain an Open Redirect vulnerability (CWE-601) due to improper validation of the 'redirect_to' parameter used in the promotional dismissal handler. This flaw allows unauthenticated attackers to craft URLs that redirect users to untrusted external sites, potentially facilitating phishing or other malicious activities. The vulnerability has a CVSS 3.1 base score of 4.7 (medium severity), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality impact, low integrity impact, and no availability impact. No patch or official fix information is currently available, and no exploits have been reported in the wild.

Successful exploitation enables unauthenticated attackers to redirect users of the affected plugin to arbitrary external URLs. This can be leveraged for phishing or social engineering attacks by redirecting users to malicious sites. The vulnerability does not directly impact confidentiality or availability but has a low impact on integrity due to the potential for misleading users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links involving the 'redirect_to' parameter in the URL Shortify plugin. Consider disabling or removing the plugin if the risk is unacceptable. Monitor vendor channels for updates or patches addressing this vulnerability.