What is the CVSS score of CVE-2026-57353?

CVE-2026-57353 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Link Whisper Premium CVE-2026-57353

EUVD-2026-41352 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Patchstack

GHSA-2565-6q46-9x5v

WordPress Authentication Bypass Wordpress Plugin Link Whisper Premium

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Subscriber-level auth required (PR:L); network-accessible plugin endpoint (AV:N); no confidentiality or availability impact, only unauthorized write/modify actions (I:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:35 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

AnalysisAI

Broken access control in Link Whisper Premium WordPress plugin versions 2.9.0 and below allows subscriber-level authenticated users to perform privileged actions that should be restricted to higher-capability roles. The flaw stems from missing authorization checks (CWE-862), enabling low-privilege users to make unauthorized modifications with high integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit for any user holding even a basic WordPress account on the target site.

Technical ContextAI

Link Whisper Premium is a paid WordPress plugin designed to automate and manage internal linking across posts and pages. The vulnerability is classified under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the authenticated requester has sufficient privileges before executing sensitive operations - a common weakness in WordPress plugins that rely on nonce checks or capability checks inconsistently. The CPE string cpe:2.3:a:linkwhisper:link_whisper_premium:*:*:*:*:*:*:*:* confirms all versions through 2.9.0 are affected with no version floor. WordPress subscriber roles have minimal capabilities by default (read-only), so any action accessible to subscribers that should require editor, author, or admin access represents a meaningful privilege escalation in the context of site content integrity.

RemediationAI

Update Link Whisper Premium to a version above 2.9.0; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/link-whisper-premium/vulnerability/wordpress-link-whisper-premium-plugin-2-9-0-broken-access-control-vulnerability?_s_id=cve should be consulted for the exact patched release version, which was not independently confirmed in the available data. As a compensating control prior to patching, site administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent untrusted parties from obtaining subscriber accounts, noting this will also prevent legitimate new user signups. Additionally, auditing existing subscriber accounts for suspicious activity is advisable, as integrity-impacting actions may have already occurred. No patch version number was independently verifiable from the provided references beyond the existence of a fix per Patchstack.