EUVD-2026-36854
GHSA-r55f-4694-6xmh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Subscriber-level auth (PR:L) required over the network (AV:N); purely a confidentiality breach with no integrity or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions.
AnalysisAI
Sensitive data exposure in the Visual Link Preview WordPress plugin (versions up to and including 2.4.1) allows authenticated users with subscriber-level access to access restricted data they should not be authorized to view. The vulnerability stems from insufficient access controls over sensitive system information (CWE-497), permitting any logged-in subscriber to trigger a disclosure endpoint or functionality that returns protected data. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the low privilege bar makes this accessible to any registered WordPress user.
Technical ContextAI
Visual Link Preview is a WordPress plugin developed by Bootstrapped Ventures (CPE: cpe:2.3:a:bootstrapped_ventures:visual_link_preview:*:*:*:*:*:*:*:*) that generates link preview metadata - typically fetching page titles, descriptions, and thumbnail images for URLs. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) describes the root cause: the plugin exposes data - likely internal site metadata, configuration details, or subscriber-accessible API responses - to a role (WordPress Subscriber) that should be restricted from viewing it. In WordPress, a Subscriber is the lowest authenticated role, capable of only reading public content; any capability check bypass or missing nonce/permission verification on an AJAX action or REST endpoint within this plugin would allow a subscriber to retrieve data intended for administrators or editors. The network-accessible nature (AV:N) of the flaw indicates it is exploitable via standard HTTP requests to the WordPress installation.
RemediationAI
Update the Visual Link Preview plugin to a version beyond 2.4.1 as soon as a patched release is published by Bootstrapped Ventures; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/visual-link-preview/vulnerability/wordpress-visual-link-preview-plugin-2-4-1-sensitive-data-exposure-vulnerability for the confirmed fixed version, which was not independently verified in the available intelligence at time of analysis. If an update is not yet available, the primary compensating control is to disable or deactivate the Visual Link Preview plugin entirely - this eliminates the attack surface at the cost of losing link preview functionality site-wide. Alternatively, if the plugin's sensitive functionality is exposed via a specific WordPress AJAX action or REST endpoint, a WAF rule or server-side block targeting that endpoint can limit exposure; however, this requires knowing the exact endpoint name, which is not confirmed in available data. Additionally, disabling open user registration (Settings > General > uncheck 'Anyone can register') raises the bar for exploitation by preventing unauthenticated visitors from creating subscriber accounts. No patch version is independently confirmed; monitor the WordPress plugin repository and Patchstack for an updated release.
More in Visual Link Preview
View allThe Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the
Sensitive data exposure in the Visual Link Preview WordPress plugin (versions 2.3.1 and earlier) allows a low-privileged
Server-Side Request Forgery (SSRF) in Brecht Visual Link Preview WordPress plugin versions through 2.3.0 allows authenti
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today