PT-2026-26845 · WordPress · Linksy Search/Replace

Nabil Irawan · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-2941

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linksy Search and Replace plugin for WordPress versions up to and including 1.0.4

Description The Linksy Search and Replace plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the linksy search and replace item details function. This allows authenticated attackers with subscriber-level access or higher to update any database table and any value within it. Specifically, attackers can modify the wp capabilities database field, enabling them to escalate their privileges to administrator level.

Recommendations Update the Linksy Search and Replace plugin to a version newer than 1.0.4.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2941

Affected Products

Linksy Search/Replace

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2941 · Security Note
• https://twitter.com/RedPacketSec/status/2035460087498658281 · Twitter Post
• https://plugins.trac.wordpress.org/browser/linksy-search-and-replace/tags/1.0.4/inc/Admin/Partials/SearchAndReplace/AjaxActions.php#L197 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0bf117e2-9e59-4028-b77f-7fce2e7174f3?source=cve · Note
• https://twitter.com/CveFindCom/status/2035215642668712234 · Twitter Post
• https://twitter.com/CVEnew/status/2035237310955233753 · Twitter Post
• https://twitter.com/TheHackerWire/status/2035446525049143475 · Twitter Post