The vulnerability in the SurfLink – Link Manager & Backup Restore WordPress plugin arises from the missing capability check (current_user_can) and a missing nonce validation in the ajax_import_410 function. These omissions allow any authenticated user with Subscriber-level access or higher to import arbitrary URLs into the 410 Gone database table. The imported URLs cause the site to return HTTP 410 Gone responses to all visitors, effectively denying legitimate access to those pages and potentially harming the site’s SEO through search engine delisting.

WordPress sites that have installed the Surflabtech SurfLink – Link Manager & Backup Restore plugin, versions up to and including 2.6.0. Any user possessing a Subscriber role or any higher capability after logging into the WordPress admin is able to trigger the vulnerable AJAX action.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1 % implies that exploitation is considered unlikely at the time of this analysis. The vulnerability is not listed in CISA’s KEV catalog. Because the attack requires an authenticated session, the likely vector is an internal user login or a compromised account possessing Subscriber privileges. With the missing authorization checks, an attacker could import malicious URLs to block access to legitimate pages, leading to noticeable availability issues and search engine problems.