CVE-2026-1900: Link Whisper Free Auth Bypass Vulnerability

CVE-2026-1900 Overview

The Link Whisper Free WordPress plugin before version 0.9.1 contains a publicly accessible REST endpoint that allows unauthenticated settings updates. This broken access control vulnerability enables remote attackers to modify plugin settings without any authentication, potentially compromising the integrity of WordPress sites using the affected plugin.

Critical Impact
Unauthenticated attackers can remotely modify plugin settings via exposed REST API endpoint, potentially leading to site configuration changes and security bypass.

Affected Products

Link Whisper Free WordPress plugin versions before 0.9.1

Discovery Timeline

2026-04-07 - CVE-2026-1900 published to NVD
2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-1900

Vulnerability Analysis

This vulnerability stems from improper access control implementation in the Link Whisper Free WordPress plugin. The plugin exposes a REST API endpoint that handles settings updates but fails to properly verify that the requesting user has appropriate authorization. As a result, any unauthenticated user who can reach the WordPress REST API can submit requests to modify plugin configuration settings.

The vulnerability is classified as a broken access control issue, which falls under the broader category of authorization bypass vulnerabilities. The network-based attack vector means exploitation can occur remotely without requiring local access to the target system. No user interaction is required for successful exploitation, making this vulnerability particularly concerning for WordPress site administrators.

Root Cause

The root cause of this vulnerability is missing authorization checks on the REST API endpoint responsible for handling settings updates in the Link Whisper Free plugin. WordPress plugins that register custom REST routes must implement their own permission callbacks to restrict access. In this case, the vulnerable endpoint either lacks a permission callback entirely or implements insufficient validation, allowing any HTTP request to the endpoint to be processed regardless of authentication status.

Attack Vector

The attack vector is network-based, allowing remote exploitation through HTTP requests to the WordPress REST API. An attacker can discover WordPress sites running vulnerable versions of Link Whisper Free and send crafted HTTP requests to the exposed REST endpoint. The attack does not require any user credentials, session tokens, or user interaction. The attacker simply needs to identify the vulnerable endpoint and construct appropriate HTTP requests to modify plugin settings.

Exploitation could enable attackers to alter link-related settings, potentially affecting SEO configurations, internal linking behavior, or other plugin functionality. Depending on how the modified settings are used by the plugin, this could lead to secondary impacts on site operation or user experience.

Detection Methods for CVE-2026-1900

Indicators of Compromise

Unexpected changes to Link Whisper Free plugin settings without administrator action
Unusual REST API requests targeting Link Whisper endpoints from unknown IP addresses
Access logs showing unauthenticated POST or PUT requests to WordPress REST API routes associated with the plugin

Detection Strategies

Monitor WordPress REST API access logs for requests to Link Whisper-related endpoints from unauthenticated sources
Implement Web Application Firewall (WAF) rules to detect and block suspicious REST API requests
Use WordPress security plugins to audit plugin settings changes and alert on unauthorized modifications
Review server access logs for patterns of reconnaissance activity targeting WordPress REST API discovery

Monitoring Recommendations

Enable detailed logging for WordPress REST API requests and review logs regularly
Set up alerts for configuration changes to the Link Whisper Free plugin settings
Monitor for bulk scanning activity targeting common WordPress plugin REST endpoints
Implement rate limiting on REST API endpoints to slow down automated exploitation attempts

How to Mitigate CVE-2026-1900

Immediate Actions Required

Update Link Whisper Free WordPress plugin to version 0.9.1 or later immediately
Review Link Whisper Free plugin settings for any unauthorized changes
Temporarily disable the plugin if an immediate update is not possible
Review access logs for evidence of prior exploitation attempts

Patch Information

The vulnerability has been addressed in Link Whisper Free version 0.9.1. Site administrators should update to this version or later through the WordPress plugin dashboard or by downloading the latest version from the official WordPress plugin repository. Additional technical details about this vulnerability can be found in the WPScan Vulnerability Report.

Workarounds

Disable the Link Whisper Free plugin until the patched version can be installed
Implement firewall rules to block unauthenticated access to WordPress REST API endpoints
Use a WordPress security plugin to restrict REST API access to authenticated users only
Consider implementing IP-based access controls to limit administrative functionality to trusted networks

bash

# Example: Restrict REST API access using .htaccess (Apache)
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/
RewriteCond %{HTTP:Authorization} ^$
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule ^wp-json/ - [F,L]
</IfModule>