Unauthenticated Settings Update Vulnerability in Link Whisper Free Plugin by WordPress
CVE-2026-1900

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Link Whisper Free
Vendor
CVE Published:
7 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-1900?

The Link Whisper Free plugin for WordPress prior to version 0.9.1 has a serious issue where its REST API endpoint is publicly accessible. This flaw allows attackers to make unauthorized changes to plugin settings without the need for authentication, potentially leading to data exposure and modification. Website administrators using this plugin should update to the latest version to secure their systems against this vulnerability.

Affected Version(s)

Link Whisper Free 0 < 0.9.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-1900 - Proof of Concept

References

https://wpscan.com/vulnerability/dc10b627-7981-4c53-bc9d-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

yiğit ibrahim sağlam
WPScan
.