6.5

CVE-2026-1900

Exploit

Link Whisper Free < 0.9.1 - Missing Authorization to Unauthenticated Settings Change

The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates.
Mögliche Gegenmaßnahme
Link Whisper Free: Update to version 0.9.1, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Link Whisper Free
Version [*, 0.9.1)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linkwhisper ≫ Link Whisper SwEditionfree SwPlatformwordpress Version < 0.9.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.03% 0.075
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.