WP Manifestindependent plugin directory
manifest / utilities / sidurl

Sidurl WP RegistryMedium-severity findings · 1 findingOpen the reportB

Simple, Quick, and Secure Short URL plugin for Wordpress. Visitor can make shorturl just like bitly or any other services

by Nur Muhammad Daim @ Satui.ID · github.com/bluecozza/sidurl · website

★ 1stars
1.5latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/bluecozza/sidurl/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/bluecozza/sidurl ↗
sidurl (Short ID Url) Simple, Quick, and Secure Short URL plugin for Wordpress. Visitor can make shorturl just like bitly or any other services HOW TO just download the release or zipped plugin, then install it on wordpress. use shortcode: sidurlform to any page you want to add the service Changelog: V1 Initial Build and first release

Releases

4 releases.

Tag
Published
1.5 latest
Feb 10, 2025 1 year ago
1.4
Feb 9, 2025 1 year ago
1.3
Feb 9, 2025 1 year ago
latest
Feb 9, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Sidurl 1.5 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.5
Findings
1
Worst severity
medium
Content hash
5a507eba534c2852b89cde3e…

Findings

  • medium Unauthenticated AJAX short-URL creation enables open-redirect phishing via site origin

    unsafe_input

    wp_ajax_nopriv_sidurl_generate (and wp_ajax_) accepts long_url after nonce check. Nonce is localized on every frontend page via wp_enqueue_scripts. Any visitor can insert arbitrary http(s) URLs into wp_sidurl and receive home_url('/'+code). template_redirect then wp_redirect()s to that long_url. Attackers host phishing behind the victim site's trusted domain. No rate limit or auth. Admin delete/recreate require manage_options.

    sidurl.php:601-652

    Recommendation

    Require login or a capability for creation; rate-limit; optionally restrict destinations to allowlisted hosts; only enqueue assets on pages with the shortcode.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →