What is the CVSS score of CVE-2026-2941?

CVE-2026-2941 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2941?

The Linksy Search and Replace WordPress plugin contains a critical privilege escalation flaw that allows any authenticated user-including those with minimal access-to gain full administrative control…

How to fix or mitigate CVE-2026-2941?

Within 24 hours: Inventory all WordPress installations using Linksy Search and Replace plugin and disable or remove the plugin immediately. Within 7 days: Audit user access logs and WordPress user roles for suspicious privilege escalations; reset credentials for all administrative accounts as a precaution. Within 30 days: Monitor vendor communications for patch availability; once released, test and deploy the patched version across all environments; conduct a full security assessment of affected systems.

WordPress CVE-2026-2941

EUVD-2026-14009 HIGH

Missing Authorization (CWE-862)

2026-03-21 Wordfence

GHSA-3wp4-fj34-73v5

Authentication Bypass WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14009

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

HIGH 8.8

DescriptionCVE.org

The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_details' function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to update any database table, any value, including the wp_capabilities database field, which allows attackers to change their own role to administrator, which leads to privilege escalation.

AnalysisAI

The Linksy Search and Replace plugin for WordPress versions up to 1.0.4 contains a missing capability check vulnerability that allows authenticated attackers with subscriber-level access or higher to modify arbitrary database tables. Attackers can exploit this to elevate their privileges to administrator by modifying the wp_capabilities field, achieving complete site takeover. With a CVSS score of 8.8 (High), this represents a critical privilege escalation vulnerability affecting authenticated users with minimal access.

Technical ContextAI

This vulnerability affects the Linksy Search and Replace plugin (cpe:2.3:a:plugli:linksy_search_and_replace) for WordPress, specifically the 'linksy_search_and_replace_item_details' function in the AjaxActions.php file. The root cause is classified as CWE-862 (Missing Authorization), where the plugin fails to implement proper capability checks before allowing database modification operations. WordPress's capability system is designed to restrict privileged operations to authorized user roles, but this plugin's AJAX handler bypasses these controls, allowing any authenticated user (including subscribers with minimal permissions) to execute database write operations. The vulnerable code at line 197 of AjaxActions.php processes search-and-replace operations without verifying whether the requesting user has sufficient privileges to modify database tables, creating a direct path for privilege escalation through modification of user role metadata stored in wp_capabilities.

RemediationAI

Immediately upgrade the Linksy Search and Replace plugin to a version newer than 1.0.4 once a patched version becomes available from the vendor. Until an official patch is released, consider removing or deactivating the plugin entirely if it is not essential to operations. As an interim mitigation, implement Web Application Firewall (WAF) rules to block POST requests to admin-ajax.php with action parameters matching 'linksy_search_and_replace_item_details', though this may impact legitimate plugin functionality. Restrict WordPress user registration to prevent unauthorized accounts from being created, and audit existing subscriber-level accounts for suspicious activity. Monitor database logs for unauthorized modifications to wp_capabilities or wp_usermeta tables. Review WordPress access logs for unusual AJAX requests from low-privilege users. Consult Wordfence's advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0bf117e2-9e59-4028-b77f-7fce2e7174f3?source=cve for updates on patch availability and additional security guidance.