What is the CVSS score of CVE-2026-1900?

CVE-2026-1900 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-1900?

Yes, a public proof-of-concept exploit is available for CVE-2026-1900. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-1900?

Yes, a patch is available for CVE-2026-1900. Update the affected software to the latest version immediately.

Link Whisper Free CVE-2026-1900

EUVD-2026-19576 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-07 WPScan

GHSA-9w5f-xhp2-5782

WordPress Authentication Bypass Link Whisper Free Unknown

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

0.9.1

PoC Detected

Apr 07, 2026 - 17:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 07, 2026 - 06:45 euvd

EUVD-2026-19576

Analysis Generated

Apr 07, 2026 - 06:45 vuln.today

CVE Published

Apr 07, 2026 - 06:00 nvd

MEDIUM 6.5

DescriptionCVE.org

The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates.

AnalysisAI

Unauthenticated attackers can modify plugin settings via a publicly accessible REST endpoint in Link Whisper Free WordPress plugin before version 0.9.1, enabling information disclosure and unauthorized configuration changes. The vulnerability has publicly available exploit code and affects all versions prior to 0.9.1. Although the CVSS score is 6.5 (medium), the EPSS score of 0.02% indicates very low real-world exploitation probability despite public POC availability.

Technical ContextAI

Link Whisper Free exposes a REST API endpoint that lacks proper authentication checks, violating the principle of secure-by-default API design in WordPress plugin development. The endpoint accepts settings updates (PR:N in CVSS vector indicates no privileges required) without validating user authentication or authorization tokens. This is a common WordPress plugin vulnerability pattern where developers expose administrative functionality through REST routes without applying WordPress's nonce or capability checks. The affected component is the plugin's settings management system, exposed via WordPress's REST API infrastructure.

RemediationAI

Upgrade Link Whisper Free WordPress plugin to version 0.9.1 or later immediately. This is the vendor-released patch that addresses the unauthenticated REST endpoint vulnerability. Site administrators should verify the plugin version in WordPress plugin management interface and update via the automatic update mechanism or manual upload. For additional details, consult the WPScan vulnerability report at https://wpscan.com/vulnerability/dc10b627-7981-4c53-bc9d-e87418f3fcfc/ and the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-1900.