CVE-2026-1900: 
WordPress vulnerability analysis and mitigation

CVE-2026-1900 is a missing authentication vulnerability in the Link Whisper Free WordPress plugin that allows unauthenticated attackers to modify plugin settings and user metadata via a publicly accessible REST endpoint. It affects all versions of Link Whisper Free before 0.9.1. The vulnerability was publicly disclosed on March 17, 2026, and added to the NVD on April 7, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, WPScan).

The root cause is CWE-306 (Missing Authentication for Critical Function) — the plugin exposes a REST API endpoint (/wp-json/link-whisper/ai-auth) without any authentication or authorization checks, classified as OWASP A5: Broken Access Control (WPScan). An attacker can send a crafted HTTP POST request to this endpoint with arbitrary parameters including access_token, user_id, uid, and uemail, and the server will process and persist these values without verifying the requester's identity. This allows modification of WordPress database entries in wp_options and wp_usermeta tables, including setting AI access authorization flags and associating attacker-controlled email addresses with existing user accounts (WPScan).

Successful exploitation allows an unauthenticated network attacker to modify plugin configuration settings and user metadata on affected WordPress installations, including setting wpil_ai_access_authorized=1 and overwriting user email metadata for arbitrary user IDs (WPScan). This could enable unauthorized access to AI-related plugin features, manipulation of user account data, and potential account takeover scenarios depending on how the plugin uses the modified metadata. Confidentiality and integrity are both partially impacted, while availability is unaffected (GitHub Advisory).

A public proof-of-concept exploit is available on WPScan, consisting of a simple curl command requiring no authentication or special privileges (WPScan). The EPSS score is approximately 0.017% (0.000170), indicating a low but non-zero probability of exploitation in the wild within 30 days. No active in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Link Whisper Free plugin version below 0.9.1 using tools like WPScan, Shodan, or by probing the REST API discovery endpoint (/wp-json/).
2. Identify the vulnerable endpoint: Confirm the presence of the /wp-json/link-whisper/ai-auth REST route on the target site.
3. Craft the malicious request: Send an unauthenticated HTTP POST request to the endpoint with attacker-controlled parameters:

curl -X POST "https://target-site.com/wp-json/link-whisper/ai-auth" \
  -d "access_token=ai-malicious123" \
  -d "user_id=attacker_controlled" \
  -d "uid=1" \
  -d "uemail=attacker@evil.com" \
  -H "Content-Type: application/x-www-form-urlencoded"

4. Verify exploitation: Confirm success by receiving an "ok" response from the server.
5. Achieve objective: The following database entries are created/modified — wp_options: wpil_ai_access_authorized=1, wpil_ai_access_user_email=attacker@evil.com; wp_usermeta: user_id=1, meta_key=wpil_ai_access_user_email, meta_value=attacker@evil.com — granting unauthorized AI feature access and manipulating user account metadata (WPScan).

• Network: Unexpected HTTP POST requests to /wp-json/link-whisper/ai-auth from unauthenticated or unknown IP addresses; requests with suspicious access_token values (e.g., arbitrary strings not matching legitimate tokens).
• Logs: WordPress access logs showing POST requests to the link-whisper/ai-auth REST endpoint from external IPs; repeated or automated requests to this endpoint in short time windows.
• Database: Unexpected or recently modified wp_options entries for wpil_ai_access_authorized or wpil_ai_access_user_email; wp_usermeta rows with meta_key=wpil_ai_access_user_email containing unrecognized email addresses.
• Application: Plugin AI features enabled unexpectedly; user accounts (especially admin accounts with uid=1) associated with unfamiliar email addresses in plugin metadata (WPScan).

Update the Link Whisper Free WordPress plugin to version 0.9.1 or later, which addresses the unauthenticated REST endpoint (WPScan, GitHub Advisory). As a temporary workaround prior to patching, administrators can restrict access to the WordPress REST API for unauthenticated users using a security plugin or server-level firewall rules blocking requests to /wp-json/link-whisper/. Additionally, review wp_options and wp_usermeta tables for unauthorized modifications to plugin-related entries as part of incident response.

The vulnerability was discovered and reported by researcher Yiğit İbrahim Sağlam (ibrahimsql), who submitted it to WPScan (WPScan). A brief technical write-up was published at infinitsec.net shortly after disclosure. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability aggregator coverage.