What is the CVSS score of CVE-2026-3552?

CVE-2026-3552 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-3552?

Yes, a patch is available for CVE-2026-3552. Update the affected software to the latest version immediately.

SurfLink WordPress Plugin CVE-2026-3552

EUVD-2026-43135 MEDIUM

Missing Authorization (CWE-862)

2026-07-11 Wordfence

GHSA-vgw6-5938-gvqv

WordPress Authentication Bypass Denial Of Service Wordpress Plugin Surflink Link Manager Backup Restore

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network AJAX vector, Subscriber auth required (PR:L); A:L added over NVD's A:N because 410 injection makes legitimate pages unavailable to all visitors.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 11, 2026 - 06:01 EUVD

Analysis Generated

Jul 11, 2026 - 05:10 vuln.today

CVE Published

Jul 11, 2026 - 03:44 cve.org

MEDIUM 4.3

DescriptionCVE.org

The SurfLink - Ultimate Link Manager plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the ajax_import_410() function in all versions up to 2.6.0. This is due to a missing capability check (current_user_can()) and missing nonce verification (check_ajax_referer()) in the ajax_import_410() function, while all other AJAX handlers in the same class (ajax_add_single_410, ajax_save_editted_410, ajax_delete_410, ajax_bulk_410_delete, ajax_empty_410, ajax_export_410) properly implement both authorization and nonce checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import arbitrary URLs into the 410 Gone database table via the surfl_import_410 AJAX action. Injected URLs will cause the site to return HTTP 410 Gone responses to all visitors accessing those paths, potentially causing denial of service for legitimate pages and SEO damage through search engine delisting.

AnalysisAI

Unauthorized data modification in SurfLink - Link Manager & Backup Restore (all versions up to 2.6.0) allows authenticated attackers with Subscriber-level access to inject arbitrary URLs into the plugin's 410 Gone database table, causing those site paths to return HTTP 410 Gone responses to all visitors. The root cause is a missing capability check (current_user_can()) and absent nonce verification (check_ajax_referer()) in the ajax_import_410() AJAX handler - a conspicuous gap given that every other AJAX handler in the same PHP class correctly implements both controls. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the low authentication barrier and clear impact on site availability and SEO ranking make this a meaningful risk for affected WordPress deployments.

Technical ContextAI

SurfLink is a WordPress plugin by Surflabtech that manages link redirects and HTTP 410 Gone responses, allowing site owners to mark removed URLs as permanently gone for SEO purposes. The plugin registers multiple AJAX actions handled by the class in class-surfl-410.php. CWE-862 (Missing Authorization) describes the root cause: the ajax_import_410() function, mapped to the surfl_import_410 WordPress AJAX action, processes bulk URL import requests without calling current_user_can() to verify the requester's privilege level or check_ajax_referer() to validate the request origin. This is a coding inconsistency: sibling handlers ajax_add_single_410, ajax_save_editted_410, ajax_delete_410, ajax_bulk_410_delete, ajax_empty_410, and ajax_export_410 all implement both controls (confirmed via source references at class-surfl-410.php lines 513 and 585). The affected CPE is cpe:2.3:a:surflabtech:surflink_-_link_manager_&_backup_restore:*:*:*:*:*:*:*:*. WordPress AJAX requests are routed through wp-admin/admin-ajax.php and require authentication for actions using the wp_ajax_ hook prefix, which accounts for the PR:L prerequisite in the CVSS vector.

RemediationAI

An upstream code fix has been committed to the SurfLink plugin repository per the changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3542304%40surflink&new=3542304%40surflink; administrators should update SurfLink to the latest version available in the WordPress plugin directory immediately, then verify the installed version post-update. The exact patched release version is not independently confirmed from the provided data - confirm via the plugin changelog after updating. As an interim compensating control, disabling open user registration (Dashboard > Settings > General, uncheck 'Anyone can register') prevents untrusted external parties from obtaining Subscriber accounts and eliminates the practical exploitation path for most sites; the trade-off is that new legitimate registrations will be blocked during the remediation window. Sites with existing Subscriber-level users of unknown trustworthiness should audit the plugin's 410 Gone database table for unexpected or injected URLs and remove any unauthorized entries. There is no known way to disable only the affected surfl_import_410 AJAX action without modifying plugin code, so patching or the registration restriction are the only recommended controls.