CVE-2021-24635: Visual Link Preview < 2.2.3 - Unauthorised AJAX Calls

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-09-20 · updated 2026-06-17
Weakness: CWE-284

Description

The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, 2) Get title of a password-protected post as well as 3) Upload an image from an URL

Affected products

brechtvds Visual Link Preview: before 2.2.3 — fixed in 2.2.3

How to fix

Upgrade to a fixed version: brechtvds Visual Link Preview 2.2.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24635 or the next vulnerability affects your stack