CVE-2026-1900: Link Whisper Free Auth Bypass Vulnerability

CVE-2026-1900 Overview

The Link Whisper Free WordPress plugin before version 0.9.1 contains a publicly accessible REST endpoint that allows unauthenticated settings updates. This broken access control vulnerability enables remote attackers to modify plugin settings without any authentication, potentially compromising the integrity of WordPress sites using the affected plugin.

Critical Impact

Unauthenticated attackers can remotely modify plugin settings via exposed REST API endpoint, potentially leading to site configuration changes and security bypass.

Affected Products

• Link Whisper Free WordPress plugin versions before 0.9.1

Discovery Timeline

• 2026-04-07 - CVE-2026-1900 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-1900

Vulnerability Analysis

This vulnerability stems from improper access control implementation in the Link Whisper Free WordPress plugin. The plugin exposes a REST API endpoint that handles settings updates but fails to properly verify that the requesting user has appropriate authorization. As a result, any unauthenticated user who can reach the WordPress REST API can submit requests to modify plugin configuration settings.

The vulnerability is classified as a broken access control issue, which falls under the broader category of authorization bypass vulnerabilities. The network-based attack vector means exploitation can occur remotely without requiring local access to the target system. No user interaction is required for successful exploitation, making this vulnerability particularly concerning for WordPress site administrators.

Root Cause

The root cause of this vulnerability is missing authorization checks on the REST API endpoint responsible for handling settings updates in the Link Whisper Free plugin. WordPress plugins that register custom REST routes must implement their own permission callbacks to restrict access. In this case, the vulnerable endpoint either lacks a permission callback entirely or implements insufficient validation, allowing any HTTP request to the endpoint to be processed regardless of authentication status.

Attack Vector

The attack vector is network-based, allowing remote exploitation through HTTP requests to the WordPress REST API. An attacker can discover WordPress sites running vulnerable versions of Link Whisper Free and send crafted HTTP requests to the exposed REST endpoint. The attack does not require any user credentials, session tokens, or user interaction. The attacker simply needs to identify the vulnerable endpoint and construct appropriate HTTP requests to modify plugin settings.

Exploitation could enable attackers to alter link-related settings, potentially affecting SEO configurations, internal linking behavior, or other plugin functionality. Depending on how the modified settings are used by the plugin, this could lead to secondary impacts on site operation or user experience.

Detection Methods for CVE-2026-1900

Indicators of Compromise

• Unexpected changes to Link Whisper Free plugin settings without administrator action
• Unusual REST API requests targeting Link Whisper endpoints from unknown IP addresses
• Access logs showing unauthenticated POST or PUT requests to WordPress REST API routes associated with the plugin

Detection Strategies

• Monitor WordPress REST API access logs for requests to Link Whisper-related endpoints from unauthenticated sources
• Implement Web Application Firewall (WAF) rules to detect and block suspicious REST API requests
• Use WordPress security plugins to audit plugin settings changes and alert on unauthorized modifications
• Review server access logs for patterns of reconnaissance activity targeting WordPress REST API discovery

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests and review logs regularly
• Set up alerts for configuration changes to the Link Whisper Free plugin settings
• Monitor for bulk scanning activity targeting common WordPress plugin REST endpoints
• Implement rate limiting on REST API endpoints to slow down automated exploitation attempts

How to Mitigate CVE-2026-1900

Immediate Actions Required

• Update Link Whisper Free WordPress plugin to version 0.9.1 or later immediately
• Review Link Whisper Free plugin settings for any unauthorized changes
• Temporarily disable the plugin if an immediate update is not possible
• Review access logs for evidence of prior exploitation attempts

Patch Information

The vulnerability has been addressed in Link Whisper Free version 0.9.1. Site administrators should update to this version or later through the WordPress plugin dashboard or by downloading the latest version from the official WordPress plugin repository. Additional technical details about this vulnerability can be found in the WPScan Vulnerability Report.

Workarounds

• Disable the Link Whisper Free plugin until the patched version can be installed
• Implement firewall rules to block unauthenticated access to WordPress REST API endpoints
• Use a WordPress security plugin to restrict REST API access to authenticated users only
• Consider implementing IP-based access controls to limit administrative functionality to trusted networks

# Example: Restrict REST API access using .htaccess (Apache)
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/
RewriteCond %{HTTP:Authorization} ^$
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule ^wp-json/ - [F,L]
</IfModule>