The Link Whisper Free WordPress plugin prior to version 0.9.1 exposes a publicly accessible REST endpoint that permits anyone to submit requests that update the plugin’s settings and user meta without authentication. This flaw allows an attacker to change configuration options, inject arbitrary data, or otherwise alter site behavior, potentially leading to defacement, unauthorized access, or information disclosure. The weakness is classified as CWE‑306 (Missing Authentication for Critical Function).

The vulnerability affects the free version of the Link Whisper WordPress plugin released before 0.9.1. Users who have not updated to 0.9.1 or later are at risk. No other vendors or products are listed. The affected plugin is part of WordPress sites that have installed the free Link Whisper plugin.

With a CVSS score of 6.5 the flaw is of moderate severity, and its EPSS score is below 1 percent, indicating a low likelihood of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits at the time of reporting. Attackers can exploit the flaw by forming HTTP requests against the REST endpoint over the network, regardless of user authentication, thus enabling remote modification of site settings without additional access.