Executive brief
The CDN Linker lite plugin for WordPress, which helps websites deliver static content like images and scripts through a Content Delivery Network (CDN), contains a security flaw. An attacker could trick a site administrator into clicking a malicious link, allowing the attacker to change the plugin's settings. This could result in the website's static assets being redirected to a server controlled by the attacker, potentially disrupting the site's appearance or functionality.
Technical details
The CDN Linker lite plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the ossdl_off_options() function. This vulnerability affects versions up to and including 1.3.1. An unauthenticated remote attacker can exploit this by inducing a site administrator to submit a forged request, typically through social engineering (e.g., clicking a malicious link). Successful exploitation allows the attacker to modify the plugin's configuration, most notably the CDN URL used to rewrite static asset references, which could lead to unauthorized content redirection.
Affected products
- CDN Linker lite Team CDN Linker lite Up to, and including, 1.3.1
Timeline
- 2026-05-27: disclosed: Vulnerability published to NVD