PT-2026-26845 · Plugli · Linksy Search/Replace

Nabil Irawan · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-2941

NVD

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy search and replace item details' function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to update any database table, any value, including the wp capabilities database field, which allows attackers to change their own role to administrator, which leads to privilege escalation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2941

Affected Products

Linksy Search/Replace

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-2941 · Security Note
• https://plugins.trac.wordpress.org/browser/linksy-search-and-replace/tags/1.0.4/inc/Admin/Partials/SearchAndReplace/AjaxActions.php#L197 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0bf117e2-9e59-4028-b77f-7fce2e7174f3?source=cve · Note