# CVE-2026-48878: Bootstrapped Ventures Visual Link Preview sensitive data exposure

Source: https://junglewise.ai/threats/cve-2026-48878-bootstrapped-ventures-visual-link-preview-sensitive-data-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-48878 · Severity: medium · CVSS 6.5 · Published 2026-06-15

The Visual Link Preview plugin for WordPress, which allows users to create custom preview boxes for links, contains a security flaw that exposes sensitive information. An attacker with a basic 'Subscriber' account can access data that should normally be restricted to administrators. This exposure could reveal system details or other internal information that helps an attacker launch more advanced attacks against the website.

Technologies: [Bootstrapped Ventures Visual Link Preview](https://junglewise.ai/threats/technologies/visual-link-preview). Vendors: [Bootstrapped Ventures](https://junglewise.ai/threats/vendors/bootstrapped-ventures).

## Quick answers

**Is CVE-2026-48878 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48878 being exploited in the wild.

**How severe is CVE-2026-48878?** Medium severity, with a CVSS score of 6.5, published 15 June 2026.

**Which products and versions are affected?** Bootstrapped Ventures Visual Link Preview <= 2.4.1.

**Is there a fix for CVE-2026-48878?** A patch was published on 2026-06-02: Version 2.4.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48878 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48878?** Check whether you run Bootstrapped Ventures Visual Link Preview at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A sensitive data exposure vulnerability exists in the Visual Link Preview plugin for WordPress (versions up to and including 2.4.1). The flaw is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). It allows an authenticated attacker with Subscriber-level privileges to access sensitive information that is not intended for their role. The vulnerability is reachable over the network without user interaction. A patch is available in version 2.4.2, which addresses the improper access control or information leakage.

## Affected products

- Bootstrapped Ventures Visual Link Preview <= 2.4.1

## Timeline

- 2026-05-14: other: Reported by Aliefis
- 2026-06-02: patched: Version 2.4.2 released
- 2026-06-15: disclosed: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/visual-link-preview/vulnerability/wordpress-visual-link-preview-plugin-2-4-1-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/visual-link-preview/vulnerability/wordpress-visual-link-preview-plugin-2-4-1-sensitive-data-exposure-vulnerability?_s_id=cve)

## Related threats

- [Bootstrapped Ventures Visual Link Preview sensitive data exposure](https://junglewise.ai/threats/cve-2026-54821-bootstrapped-ventures-visual-link-preview-sensitive-data-exposure)