The vulnerability in the Internal Links Manager plugin allows a forged request to bypass nonce validation in the link deletion workflow, enabling an attacker to delete SEO links without authentication. This results in accidental removal of internal link data that could affect site search ranking and content integrity. The flaw is a classic CSRF weakness, classified as CWE‑352.

WordPress plugin Internal Links Manager from vendor webraketen, affecting all releases up to and including version 3.0.1. No specific sub‑versions within that range are singled out; any installation of 3.0.1 or earlier is vulnerable.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires the attacker to trick a site administrator into executing a URL that triggers the bulk deletion action, so social engineering remains a prerequisite. If successful, the attacker gains the ability to delete internal links, potentially derailing SEO efforts but not compromising the core WordPress installation.