Linksy Search And Replace CVE-2026-2941

Requires WordPress with the Linksy Search and Replace plugin version 1.0.4 or earlier installed and activated. Attacker must have authenticated access as a subscriber or higher-privilege user. No victim interaction needed; authenticated attacker directly exploits missing capability check to escalate to administrator role.

This vulnerability presents a high real-world risk despite requiring authentication. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible exploitation with low complexity and low privilege requirements, making it highly practical for attackers who obtain subscriber-level credentials through phishing, credential stuffing, or open registration. The impact is severe as successful exploitation grants complete administrative control over the WordPress installation, enabling attackers to install backdoors, modify content, steal data, or deploy malware. While no EPSS score or KEV status is provided in the intelligence data, the combination of low attack complexity, minimal privilege requirements, and complete system compromise makes this a priority remediation target. The availability of source code references in the WordPress plugin repository increases the likelihood that proof-of-concept exploits will emerge rapidly. Organizations using this plugin should treat this as urgent regardless of EPSS scoring, as privilege escalation vulnerabilities in popular CMS plugins are frequently exploited in opportunistic attacks.

An attacker registers a subscriber account on a WordPress site using the vulnerable Linksy Search and Replace plugin or compromises existing low-privilege credentials through phishing. The attacker crafts a malicious POST request to the WordPress AJAX handler, invoking the 'linksy_search_and_replace_item_details' function with parameters targeting the wp_usermeta or wp_capabilities table to modify their own user role from subscriber to administrator. Within seconds, the attacker gains full administrative access to the WordPress installation, allowing them to install malicious plugins, create backdoor accounts, exfiltrate sensitive data, or deface the website. The attack requires no user interaction and can be automated for mass exploitation across vulnerable installations.