PT-2026-26845 · WordPress · Linksy Search/Replace

Nabil Irawan · CVE-2026-2941 · Publicado 2026-03-21 · Atualizado 2026-03-21

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linksy Search and Replace plugin for WordPress versions up to and including 1.0.4

Description The Linksy Search and Replace plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the linksy search and replace item details function. This allows authenticated attackers with subscriber-level access or higher to update any database table and any value within it. Specifically, attackers can modify the wp capabilities database field, enabling them to escalate their privileges to administrator level.

Recommendations Update the Linksy Search and Replace plugin to a version newer than 1.0.4.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-2941

Produtos afetados

Linksy Search/Replace

Referências · 7

• https://twitter.com/RedPacketSec/status/2035460087498658281 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/linksy-search-and-replace/tags/1.0.4/inc/Admin/Partials/SearchAndReplace/AjaxActions.php#L197 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/0bf117e2-9e59-4028-b77f-7fce2e7174f3?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2941 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2035215642668712234 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035237310955233753 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2035446525049143475 · Publicação no Twitter