Simple Link Directory Pro CVE-2026-61981

Exploitation requires that the target WordPress site has Simple Link Directory Pro version ≤15.0.8 installed and active, and that a user with sufficient privileges to perform the targeted plugin action (typically a WordPress administrator or editor) is actively authenticated in the same browser session at the time the forged request fires. The attacker must successfully deliver a malicious page or link to the victim and induce them to load it while logged in - this is the primary limiting factor. CVSS UI:R explicitly encodes this victim-interaction requirement. There is no known requirement for any non-default plugin configuration; the flaw appears to affect standard plugin operation. Exploitation is bounded to the plugin's own data scope - it does not provide OS-level access, credential disclosure, or WordPress core privilege escalation based on the C:N/I:L/A:L impact metrics.

The CVSS 5.4 Medium score is internally consistent: AV:N (network-delivered payload), AC:L (no special conditions), PR:N (attacker needs no account), UI:R (victim must interact), S:U (no scope change), C:N/I:L/A:L (limited impact). This is not listed in the CISA KEV catalog and no EPSS data was provided, meaning real-world exploitation probability appears low. The requirement for victim interaction (UI:R) is a meaningful friction point - exploitation depends on successfully phishing a logged-in WordPress administrator. Real-world risk is modest: an attacker can at most modify or disrupt the link directory data, not gain code execution or extract credentials. No POC code was referenced in the available intelligence, and the vulnerability was responsibly reported through Patchstack's coordinated disclosure program. This is a genuine but low-urgency issue for most organizations - elevated slightly for sites where the link directory data is business-critical or where administrator phishing is a plausible threat model.

An attacker identifies a WordPress site running Simple Link Directory Pro ≤15.0.8 and crafts a hidden HTML form or img tag that submits a forged admin request to the plugin's endpoint. The attacker sends a phishing email or embeds the payload on a page likely to be visited by the site's logged-in administrator; when the administrator's browser loads the page, it automatically fires the forged request authenticated by the admin's existing session cookie, causing unauthorized creation, modification, or deletion of link directory entries. No public POC was identified at time of analysis, but the attack is straightforward to construct given the well-understood CSRF pattern in WordPress plugins.