CVE-2026-2941 - Vulnerability Analysis

Overview

Linksy Search and Replace WordPress plugin <= 1.0.4 contains a broken access control vulnerability caused by missing capability check in 'linksy_search_and_replace_item_details' function, letting authenticated attackers with subscriber-level access modify any database value, including wp_capabilities, leading to privilege escalation.

Severity & Score

Impact

Authenticated attackers can escalate privileges to administrator by modifying database values, compromising site security.

Mitigation

Update to the latest version beyond 1.0.4.

References

• https://plugins.trac.wordpress.org/browser/linksy-search-and-replace/tags/1.0.4/inc/Admin/Partials/SearchAndReplace/AjaxActions.php#L197
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0bf117e2-9e59-4028-b77f-7fce2e7174f3?source=cve

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 21, 2026

🟠 CVE-2026-2941 - High (8.8) The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_details' function in all versions up to, and including, 1.0.4. This make... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2941/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner