What is the CVSS score of CVE-2026-61981?

CVE-2026-61981 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Simple Link Directory Pro CVE-2026-61981

EUVD-2026-48213 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-23 Patchstack

GHSA-hmrj-v2v6-qp25

CSRF Simple Link Directory Pro

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-delivered CSRF needs no attacker privileges but requires active admin interaction; scope is unchanged with only low integrity and availability impact to the plugin's own data.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:30 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.

AnalysisAI

Cross-Site Request Forgery in Simple Link Directory Pro WordPress plugin (≤15.0.8) enables a remote unauthenticated attacker to execute unauthorized state-changing actions on a victim's WordPress installation by tricking an authenticated administrator into clicking a crafted malicious link. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials of their own, but must socially engineer an authenticated administrator to trigger the forged request. No public exploit code or active exploitation has been identified at time of analysis, and CVSS impact signals are limited to low integrity and availability degradation with no confidentiality loss.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) describes a flaw where the application fails to verify that a state-changing HTTP request was intentionally submitted by the authenticated user - typically because it does not validate WordPress nonces or check the request origin header. Simple Link Directory Pro is a premium WordPress plugin developed by QuantumCloud for managing link directories. The affected CPE is cpe:2.3:a:quantumcloud:simple_link_directory_pro:*:*:*:*:*:*:*:*, covering all versions through 15.0.8. Because WordPress plugins operate within the WordPress request lifecycle, missing nonce validation on admin-facing AJAX handlers or form processors is a classic CSRF attack surface in this ecosystem.

RemediationAI

The primary remediation is to update Simple Link Directory Pro to a version above 15.0.8; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/simple-link-directory-pro/vulnerability/wordpress-simple-link-directory-pro-plugin-15-0-8-cross-site-request-forgery-csrf-vulnerability) and the WordPress plugin repository for the patched release version, which was not independently confirmed in the available data. If an immediate update is not possible, a compensating control is to restrict access to the WordPress admin dashboard via IP allowlisting at the web server or firewall level, reducing the attack surface by limiting which users can be socially engineered into triggering the forged request - the trade-off is reduced remote admin flexibility. Alternatively, a WordPress firewall plugin such as Wordfence or Patchstack's own virtual patching feature can block the malformed CSRF request at runtime without modifying the vulnerable plugin code. Temporarily deactivating the plugin is the most conservative fallback if none of the above options are viable.