Data Modification Vulnerability in SurfLink Plugin for WordPress

CVE-2026-3552

What is CVE-2026-3552?

The SurfLink - Ultimate Link Manager plugin for WordPress is susceptible to unauthorized data modification due to a lack of capability checks in the ajax_import_410() function. This vulnerability affects all versions up to 2.6.0. The absence of both user permission verification and nonce checks allows authenticated attackers with Subscriber-level access and above to manipulate the 410 Gone database. By importing arbitrary URLs, these attackers can lead to denial of service for legitimate pages and risk severe SEO repercussions as access to those URLs would return HTTP 410 Gone responses.

References