The Linksy Search and Replace WordPress plugin contains a missing capability check in the 'linksy_search_and_replace_item_details' function. This omission allows authenticated users with subscriber-level access or higher to execute arbitrary updates on any database table, including sensitive fields such as 'wp_capabilities'. An attacker can modify role assignments to elevate their own privileges to administrator, effectively bypassing normal access controls and gaining full control of the site.

The vulnerability affects the Linksy Search and Replace plugin version 1.0.4 and all prior versions. WordPress sites that have this plugin installed and are running a version where this function is unprotected are at risk. The issue is limited to the plugin, but its impact is system-wide because it permits modifications to any database entry.

The CVSS score of 8.8 indicates a high severity. No EPSS data is available, and the flaw is not listed in CISA’s KEV catalog. The attack requires authentication as a subscriber or higher, making it a local‑authenticated threat vector. Once exploited, the attacker achieves privilege escalation, enabling control over site content, settings, and potentially other plugins.