CVE-2026-2941
Privilege Escalation via Missing Capability Check in Linksy Plugin
Publication date: 2026-03-21
Last updated on: 2026-03-21
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linksy | search_and_replace | to 1.0.4 (inc) |
| plugli | linksy_search_and_replace | to 1.0.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Linksy Search and Replace plugin for WordPress has a vulnerability due to a missing capability check in the 'linksy_search_and_replace_item_details' function in all versions up to 1.0.4.
This flaw allows authenticated attackers with subscriber-level access or higher to modify any database table and any value, including the wp_capabilities field.
By changing the wp_capabilities field, attackers can escalate their privileges by changing their own role to administrator.
How can this vulnerability impact me? :
This vulnerability can lead to privilege escalation where an attacker with low-level access (subscriber) can gain administrator privileges.
With administrator access, the attacker can fully control the WordPress site, including modifying content, installing malicious plugins, stealing data, or disrupting site operations.
The vulnerability also allows unauthorized modification of any database table and value, which can compromise the integrity and security of the entire website.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability involves unauthorized modification of database entries via the 'linksy_search_and_replace_item_details' function in the Linksy Search and Replace WordPress plugin. Detection would involve monitoring for unexpected changes to database tables, especially the wp_capabilities field, which could indicate privilege escalation."}, {'type': 'paragraph', 'content': "Since the vulnerability allows authenticated users with subscriber-level access to update database values, detection can include auditing database changes and reviewing logs for suspicious AJAX requests targeting the plugin's endpoints."}, {'type': 'paragraph', 'content': 'Specific commands or methods to detect this vulnerability are not provided in the available resources.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or removing the Linksy Search and Replace plugin if it is installed and running a vulnerable version (up to and including 1.0.4).
Restrict access to the WordPress admin area to trusted users only and review user roles to ensure no unauthorized privilege escalation has occurred.
Monitor and audit database changes, especially to the wp_capabilities field, to detect any unauthorized role changes.
Apply any available patches or updates from the plugin developer once released.