What is the CVSS score of CVE-2026-54821?

CVE-2026-54821 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Visual Link Preview are affected by CVE-2026-54821?

The Visual Link Preview WordPress plugin (versions ≤2.3.1) contains a data exposure vulnerability that allows authenticated low-privilege users to access information beyond their authorized scope,…

How to fix or mitigate CVE-2026-54821?

Within 24 hours: Inventory all WordPress instances running Visual Link Preview versions 2.3.1 or earlier and notify stakeholders of exposure scope. Within 7 days: Temporarily disable the Visual Link Preview plugin across affected installations, or implement strict Subscriber-level access restrictions to minimize data exposure surface. Within 30 days: Monitor vendor security advisories for patch availability; when available, prepare patch for testing in a staging environment before production deployment.

Visual Link Preview CVE-2026-54821

EUVD-2026-39363 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-25 Patchstack

GHSA-pvgh-wqw8-6fxp

WordPress Information Disclosure Visual Link Preview Wordpress Plugin Bootstrapped Ventures

7.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

vuln.today AI

5.0 MEDIUM

Network-reachable endpoint needs a Subscriber account (PR:L) and no interaction (UI:N); a pure CWE-201 data leak crosses the authz boundary (S:C) with low confidentiality impact and no genuine integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:16 vuln.today

DescriptionCVE.org

Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.

AnalysisAI

Sensitive data exposure in the Visual Link Preview WordPress plugin (versions 2.3.1 and earlier) allows a low-privileged Subscriber-level authenticated user to access information they should not be authorized to view. The CVSS 3.1 vector (PR:L) indicates only minimal authenticated access is needed, and the changed scope reflects data leaking beyond the plugin's intended security boundary. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

Visual Link Preview is a WordPress plugin (vendor namespace bootstrapped_ventures) that generates rich visual previews of linked URLs within posts and pages. The weakness maps to CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin returns sensitive information in a response or output that a given requester should not be able to retrieve. In WordPress terms this typically stems from a plugin AJAX action, REST endpoint, or admin handler that fails to enforce capability checks, allowing the lowest-privilege authenticated role (Subscriber) to receive data intended for higher roles. The CPE cpe:2.3:a:bootstrapped_ventures:visual_link_preview:*:*:*:*:*:*:*:* covers all versions up to and including 2.3.1.

RemediationAI

No vendor-released patch version is identified in the available data; the advisory only confirms that versions up to and including 2.3.1 are affected, so administrators should check the WordPress plugin repository and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/visual-link-preview/vulnerability/wordpress-visual-link-preview-plugin-2-3-1-sensitive-data-exposure-vulnerability) for any release above 2.3.1 and upgrade as soon as one is published. Until a fixed version is confirmed, the most effective compensating controls are to disable and remove the Visual Link Preview plugin if it is not essential (eliminating the vulnerable code path entirely, at the cost of losing link-preview functionality), and to disable open user self-registration (Settings > General > 'Anyone can register') so that an attacker cannot trivially obtain the Subscriber account the exploit requires - this prevents anonymous abuse but does not protect against existing low-privilege users. As a network-layer control, a WAF rule or Patchstack's virtual patching can be applied to block the affected plugin endpoint, with the trade-off of potential false positives on legitimate preview requests.