CVE-2021-24749

The URL Shortify plugin prior to version 1.5.11 lacks proper cross-site request forgery protection on its bulk deletion functionality for both links and groups. An attacker could exploit this vulnerability to trick an authenticated administrator into inadvertently removing arbitrary links and groups through a malicious request. The absence of CSRF tokens or verification allows unauthorized deletion operations to be performed without the admin's knowledge or consent.

Based on public CVE data (MITRE/NVD).