CVE-2026-57353 MEDIUM

CVE-2026-57353: WordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerability

Vendor Linkwhisper
Product Link Whisper Premium
Weakness CWE-862 · Missing authorization
Published July 2, 2026
Last update July 2, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Link Whisper Premium versions up to 2.9.0 lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with a low-privilege account can alter data integrity without requiring user interaction. The vulnerability affects the plugin's core functionality and could impact site content management.

What an attacker can do

03Attacker Capabilities

Modify or alter site content and data that the attacker's account should not have permission to change.

Potential impact on your site

04Site Impact

Unauthorized users can alter site content, pages, or settings, compromising data integrity and site reliability.

Conditions required to exploit

05Prerequisites

Attacker must have a valid low-privilege user account on the site.

Key dates

06Disclosure timeline

July 2, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-58377 JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys CVE-2026-57339 WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability CVE-2026-57750 WordPress ez Form Calculator Premium plugin <= 2.14.1.2 - Broken Access Control vulnerability CVE-2025-2902 Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform CVE-2026-57669 WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability