What is the CVSS score of CVE-2026-66464?

CVE-2026-66464 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Internal Link Optimiser CVE-2026-66464

Q: Which versions of Internal Link Optimiser are affected by CVE-2026-66464?

Broken access control in Internal Link Optimiser (WordPress plugin by Toast Plugins) versions up to and including 5.2.7 exposes restricted plugin functionality to unauthenticated network attackers.

EUVD-2026-57883 MEDIUM

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-7v4h-xrw2-xw45

WordPress Authentication Bypass Wordpress Plugin Internal Link Optimiser

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated access with no complexity; impact capped at partial read/write of plugin data, no availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:14 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.

AnalysisAI

Broken access control in Internal Link Optimiser (WordPress plugin by Toast Plugins) versions up to and including 5.2.7 exposes restricted plugin functionality to unauthenticated network attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no credentials or user interaction are required, allowing any remote party to interact with privileged plugin endpoints on affected WordPress installations. The impact is limited to partial confidentiality and integrity compromise - consistent with unauthorized read or write access to internal link data - with no availability impact identified. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Internal Link Optimiser is a WordPress plugin developed by Toast Plugins (CPE: cpe:2.3:a:toast_plugins:internal_link_optimiser:*:*:*:*:*:*:*:*) designed to manage and optimize internal linking within WordPress sites. The vulnerability is classified under CWE-862 (Missing Authorization), a well-documented root cause in the WordPress ecosystem where plugin actions - typically registered via AJAX hooks or REST API routes - fail to verify that the requesting user holds sufficient permissions before executing privileged operations. This pattern allows unauthenticated callers to invoke functionality that should be gated behind subscriber, editor, or administrator roles. The broken access control tag confirms that authorization checks are absent or bypassable rather than merely weak, placing this firmly in the access-control failure category rather than an authentication bypass of a credential-checking mechanism.

RemediationAI

The primary remediation is to update the Internal Link Optimiser plugin to a version released after 5.2.7; however, the specific patched version number is not independently confirmed from the available input data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/internal-link-finder/vulnerability/wordpress-internal-link-optimiser-plugin-5-2-7-broken-access-control-vulnerability and the WordPress plugin repository for the latest available release. If an update is not immediately possible, a viable compensating control is to deactivate the plugin entirely until a patch is applied, eliminating the vulnerable attack surface with no functional impact beyond loss of internal link optimization features. Alternatively, a web application firewall (WAF) rule that restricts unauthenticated access to the plugin's AJAX or REST endpoints can reduce exposure, though this requires knowing the specific endpoint paths and carries a risk of false positives affecting legitimate admin usage. Restricting wp-admin and wp-json paths to authenticated sessions at the server or WAF layer is an additional layer but is not a substitute for patching.