PT-2025-38632 · WordPress · Internal Links Manager

Beven Nyamande + 1 · CVE-2025-9949 · Published 2025-09-20 · Updated 2025-09-20

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Internal Links Manager plugin for WordPress versions through 3.0.1

Description The Internal Links Manager plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the link deletion functionality within the process bulk action() function. This allows unauthenticated attackers to delete SEO links by forging requests, provided they can trick a site administrator into performing an action.

Recommendations Update the Internal Links Manager plugin to a version beyond 3.0.1.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-9949

Affected Products

Internal Links Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9949 · Security Note
• https://wordpress.org/plugins/seo-automated-link-building · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362770%40seo-automated-link-building&new=3362770%40seo-automated-link-building&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e0e5e143-c4de-4312-8c8b-acf7ef60e0d5?source=cve · Note
• https://twitter.com/CVEnew/status/1969291918451367994 · Twitter Post
• https://t.me/CVEtracker/32989 · Telegram Post