6.5

CVE-2026-1900

Exploit

Link Whisper Free < 0.9.1 - Unauthenticated Settings and User Meta Update

Link Whisper Free < 0.9.1 - Missing Authorization to Unauthenticated Settings Change

The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates.
Mögliche Gegenmaßnahme
Link Whisper Free: Update to version 0.9.1, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linkwhisper ≫ Link Whisper SwEditionfree SwPlatformwordpress Version < 0.9.1
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Link Whisper Free
Version [*, 0.9.1)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.19% 0.083
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://wpscan.com/vulnerability/dc10b627-7981-4c53-bc9d-e87418f3fcfc/
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/2a4289b1-ca9f-4045-a00f-50eba713b52f
Third Party Advisory