CVE-2025-49884: 
WordPress vulnerability analysis and mitigation

CVE-2025-49884 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin "Internal Linking of Related Contents" by developer alexvtn. It allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially performing privileged actions without authentication. The vulnerability affects all plugin versions up to and including 1.1.8, with version 1.1.9 containing the fix. It was reported on May 29, 2025, published by Patchstack on July 8, 2025, and assigned a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to perform adequate authorization checks before executing privileged operations (Patchstack). Specifically, the plugin lacks proper nonce token, authentication, or capability checks on certain functions, enabling unauthenticated users to invoke actions that should be restricted to higher-privileged roles. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it accessible to unsophisticated attackers. No public proof-of-concept exploit code has been identified at this time.

Successful exploitation allows unauthenticated attackers to perform unauthorized actions within the WordPress site that are normally restricted to privileged users, affecting both the integrity and availability of the site (CVSS integrity and availability impacts rated Low). While the vulnerability does not directly expose sensitive data (no confidentiality impact), it could be leveraged to manipulate internal linking configurations, potentially disrupting site content or SEO structure. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

The vulnerability requires no authentication and no user interaction, making it trivially exploitable by any remote attacker. Patchstack has assessed it as expected to become exploited and has issued a virtual patch/mitigation rule for its users. The EPSS score is approximately 0.039% (0.000390), indicating a currently low but non-negligible probability of exploitation in the near term. No in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported as of the time of publication (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "Internal Linking of Related Contents" plugin version 1.1.8 or earlier using tools like WPScan, Shodan, or by checking publicly accessible readme.txt files at /wp-content/plugins/internal-linking-of-related-contents/readme.txt.
2. Identify unprotected endpoints: Enumerate WordPress AJAX actions or REST API endpoints registered by the plugin that lack capability or nonce checks, which can be discovered through source code review or fuzzing.
3. Craft unauthorized request: Send an unauthenticated HTTP POST request (e.g., to wp-admin/admin-ajax.php with the relevant action parameter, or to the applicable REST endpoint) invoking the privileged function without supplying authentication credentials or a valid nonce.
4. Execute privileged action: The server processes the request without authorization validation, allowing the attacker to modify plugin settings, alter internal linking configurations, or trigger other restricted functionality (Patchstack).

• Network: Unusual unauthenticated POST requests to wp-admin/admin-ajax.php or REST API endpoints associated with the internal-linking-of-related-contents plugin, particularly from unfamiliar or automated IP addresses.
• Logs: WordPress access logs showing repeated requests to plugin-specific AJAX actions without valid nonce tokens or session cookies; HTTP 200 responses to requests that should require authentication.
• File System: Unexpected changes to plugin configuration files or database entries related to internal linking settings that were not made by a logged-in administrator.
• Process/Application: Unexplained modifications to internal link structures or related content configurations visible in the WordPress admin dashboard without corresponding admin activity logs.

The vendor has released version 1.1.9 of the "Internal Linking of Related Contents" plugin, which patches this vulnerability; administrators should update immediately via the WordPress plugin dashboard (Patchstack). Patchstack users benefit from an automatically deployed virtual patch/mitigation rule that blocks exploitation attempts until the plugin is updated. If an immediate update is not possible, site owners should consult their hosting provider or web developer, and consider temporarily deactivating the plugin to reduce exposure.

The vulnerability was discovered and reported by security researcher Martino Spagnuolo (r3verii) on May 29, 2025, and published by Patchstack on July 8, 2025 (Patchstack). Patchstack highlighted that broken access control vulnerabilities of this type are frequently leveraged in mass-exploit campaigns against WordPress sites. No significant broader media coverage or notable social media discussion beyond standard vulnerability aggregator postings has been identified.