This vulnerability is a missing authorization flaw in the Link Whisper Free WordPress plugin. An attacker who can reach the plugin’s admin interface can use incorrectly configured access control to perform actions normally restricted. The weakness is categorized as CWE-862, giving the attacker the ability to bypass authentication checks and potentially expose or alter content managed through WordPress.

The affected product is the Link Whisper Free plugin developed by Spencer Haws, available with all WordPress installations that have installed the plugin. Versions from the initial release up through 0.9.2 are impacted. No additional vendors or products are listed.

The CVSS score of 5.3 indicates moderate risk. The EPSS score of < 1% suggests low likelihood of exploit. The vulnerability is not listed in CISA’s KEV. The attack likely requires that the attacker has access to a user account with sufficient privileges to reach the plugin’s configuration pages, or can otherwise submit requests to the plugin’s administrative endpoints. No exploit code is publicly available, so the vulnerability is considered low leverage for a fully remote attacker.