Junglewise Threat Intelligence

CVE-2026-3552: SurfLink Ultimate Link Manager missing authorization in ajax_import_410

CVE-2026-3552 · Severity: medium · CVSS 4.3 · Published 2026-07-11

Executive brief

The SurfLink plugin for WordPress, which is used to manage website links and redirects, contains a security flaw that allows low-level users to modify site data. An attacker with a basic account (such as a subscriber) could mark legitimate website pages as 'permanently gone.' This would cause visitors to see error pages instead of content and could lead to the website being removed from search engine results, damaging the site's reputation and traffic.

Technical details

The vulnerability is classified as Missing Authorization (CWE-862) within the ajax_import_410() function of the SurfLink plugin. The root cause is a failure to implement both a capability check (current_user_can()) and a nonce verification (check_ajax_referer()) in this specific AJAX handler, despite other handlers in the same class being properly secured. An authenticated attacker with Subscriber-level permissions or higher can trigger the surfl_import_410 action to inject arbitrary URLs into the plugin's '410 Gone' database table. Once injected, the site will return HTTP 410 responses for those paths, effectively disabling access to legitimate pages and potentially triggering search engine delisting. The issue is addressed in version 2.6.0.

Affected products

  • surflabtech SurfLink – Link Manager & Backup Restore up to 2.6.0

Timeline

  • 2026-07-11: advisory: NVD publication date

References