CVE-2026-1900

CVE-2026-1900 is an authentication bypass vulnerability affecting the Link Whisper Free WordPress plugin versions prior to 0.9.1. The vulnerability stems from an improperly secured REST API endpoint that permits unauthenticated users to modify plugin settings without authorization. This flaw exposes WordPress installations using the affected plugin to potential configuration tampering and data integrity issues. The vulnerability presents a medium severity risk with a CVSS score of 6.5, characterized by network-based exploitation requiring no authentication or user interaction. While the attack has low complexity and can impact both confidentiality and integrity of plugin settings, the availability of systems remains unaffected. Organizations using this plugin should prioritize patching to version 0.9.1 or later to remediate the exposure. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows minimal community attention with an exceptionally low EPSS score of 0.00033. There is no evidence of active exploitation in the wild at this time. However, given the straightforward nature of the vulnerability and the public disclosure of the REST endpoint flaw, security teams should monitor for proof-of-concept exploit development and apply patches proactively.