Internal Link Finder Vulnerabilities

The Website Internal Link Optimiser plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 5.2.7

Fix:

No patched version reported

Disclosed:

Aug 10, 2026

CVE-2026-66464 on NVD →

The WordPress Internal Link Optimiser plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts...

CVSS:

6.1

Affected:

up to 5.1.3

Fixed in:

5.1.4

Disclosed:

Apr 16, 2025

CVE-2025-39547 on NVD →

The WordPress Internal Link Optimiser plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ~/templates/backend.php file in all versions up to, and including, 5.1.2. This makes it possible for unauthenticated attackers to update plugin settings.

CVSS:

5.3

Affected:

up to 5.1.2

Fixed in:

5.1.3

Disclosed:

Apr 7, 2025

CVE-2025-32243 on NVD →