Internal Link Optimiser
Monthly
Broken access control in Internal Link Optimiser (WordPress plugin by Toast Plugins) versions up to and including 5.2.7 exposes restricted plugin functionality to unauthenticated network attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no credentials or user interaction are required, allowing any remote party to interact with privileged plugin endpoints on affected WordPress installations. The impact is limited to partial confidentiality and integrity compromise - consistent with unauthorized read or write access to internal link data - with no availability impact identified. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in Internal Link Optimiser (WordPress plugin by Toast Plugins) versions up to and including 5.2.7 exposes restricted plugin functionality to unauthenticated network attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no credentials or user interaction are required, allowing any remote party to interact with privileged plugin endpoints on affected WordPress installations. The impact is limited to partial confidentiality and integrity compromise - consistent with unauthorized read or write access to internal link data - with no availability impact identified. No public exploit code or CISA KEV listing has been identified at time of analysis.