A critical missing authorization flaw in the Md Yeasin Ul Haider URL Shortener plugin allows unauthenticated remote attackers to bypass access controls, posing a significant risk to site integrity.

The vulnerability is a case of missing authorization (CWE-862) within the exact-links component, which fails to perform necessary capability checks. This allows unauthenticated users to execute functions that should be restricted to authorized administrators.

Successful exploitation of this vulnerability could lead to unauthorized modification of link data or the execution of administrative functions, potentially resulting in site defacement or the redirection of traffic to malicious destinations. Given the CVSS score of 8.6, this represents a high-severity risk that could undermine the integrity of the web application and compromise user trust.

Immediate Action: Since no official patch is currently confirmed, administrators should deactivate and remove the URL Shortener plugin until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for unusual requests directed at URL shortener endpoints, particularly those originating from unauthorized IP addresses or attempting to access administrative paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to the plugin's specific endpoints, though this should be considered a temporary measure only.

Public Exploit Available: No — exploit_available (false).

Due to the lack of a verified patch and the high CVSS score, the risk of unauthorized access is significant. Organizations using this plugin should prioritize removing the software from their environments immediately to prevent potential exploitation of these missing access controls.