CVE-2025-9949

The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the process_bulk_action() function. This makes it possible for unauthenticated attackers to delete SEO links via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362770%40seo-automated-link-building&new=3362770%40seo-automated-link-building&sfp_email=&sfph_mail=
• https://wordpress.org/plugins/seo-automated-link-building/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e5e143-c4de-4312-8c8b-acf7ef60e0d5?source=cve

Published

Sep 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9943An SQL injection vulnerability has been identified in the "I…9.1
• CVE-2025-9944The Professional Contact Form plugin for WordPress is vulner…4.3
• CVE-2025-9945The Optimize More! – CSS plugin for WordPress is vulnerable …4.3
• CVE-2025-9946The LockerPress – WordPress Security Plugin plugin for WordP…6.1
• CVE-2025-9947The Custom 404 Pro plugin for WordPress is vulnerable to tim…4.9
• CVE-2025-9948The Chat by Chatwee plugin for WordPress is vulnerable to Cr…4.3
• CVE-2025-9950The Error Log Viewer by BestWebSoft plugin for WordPress is …4.9
• CVE-2025-9951A heap-buffer-overflow write exists in jpeg2000dec FFmpeg wh…7.2
• CVE-2025-9952The Trinity Audio – Text to Speech AI audio player to conver…6.1
• CVE-2025-9953Authorization Bypass Through User-Controlled SQL Primary Key…9.8
• CVE-2025-9954Missing Authorization vulnerability in Drupal Acquia DAM all…7.5
• CVE-2025-9955An improper access control vulnerability exists in WSO2 Ente…5.7