Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-3552— SurfLink < 2.6.0 - Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via 'surfl_import_410' AJAX Action

Quick assessment

Affected
surflabtech SurfLink – Link Manager & Backup Restore
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress SurfLink是WordPress基金会的一款集链接管理、重定向、数据库搜索替换、备份恢复和安全防护于一体的模块化 WordPress 插件，用户可按需启用功能，免费版已覆盖核心需求，Pro 版则扩展了短链接、自动链接、断链检测等高级特性。 WordPress SurfLink 2.6.0及之前版本存在授权问题漏洞，该漏洞源于对ajax_import_410()函数缺少功能检查（current_user_can()）和随机数验证（check_ajax_referer()），可能导致已

CVSS 4.3 · Medium EPSS 0.21% · P12

Affected Version Matrix 1

VendorProduct Version RangeStatus
surflabtech SurfLink – Link Manager & Backup Restore < 2.6.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-3552

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SurfLink < 2.6.0 - Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via 'surfl_import_410' AJAX Action
Source: CVE Program / CVE List V5
Vulnerability Description
The SurfLink - Ultimate Link Manager plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the ajax_import_410() function in all versions up to 2.6.0. This is due to a missing capability check (current_user_can()) and missing nonce verification (check_ajax_referer()) in the ajax_import_410() function, while all other AJAX handlers in the same class (ajax_add_single_410, ajax_save_editted_410, ajax_delete_410, ajax_bulk_410_delete, ajax_empty_410, ajax_export_410) properly implement both authorization and nonce checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import arbitrary URLs into the 410 Gone database table via the surfl_import_410 AJAX action. Injected URLs will cause the site to return HTTP 410 Gone responses to all visitors accessing those paths, potentially causing denial of service for legitimate pages and SEO damage through search engine delisting.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress SurfLink 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress SurfLink是WordPress基金会的一款集链接管理、重定向、数据库搜索替换、备份恢复和安全防护于一体的模块化 WordPress 插件，用户可按需启用功能，免费版已覆盖核心需求，Pro 版则扩展了短链接、自动链接、断链检测等高级特性。 WordPress SurfLink 2.6.0及之前版本存在授权问题漏洞，该漏洞源于对ajax_import_410()函数缺少功能检查（current_user_can()）和随机数验证（check_ajax_referer()），可能导致已
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
surflabtech SurfLink – Link Manager & Backup Restore 0 ~ 2.6.0 -

II. Public POCs for CVE-2026-3552

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-3552

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-3552 (5)

Vendor Advisories for CVE-2026-3552 (1)

Other References for CVE-2026-3552 (1)

IV. Related Vulnerabilities

Same weakness: CWE-862

V. Comments for CVE-2026-3552

No comments yet

Leave a comment