{
 "id": "WPSEC-2026-1385",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1385/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1385/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1385/index.md",
 "title": "Internet Archive Wayback Machine Link Fixer <= 1.4.2 - Improper Certificate Validation Leading to archive.org Credential Exposure",
 "description": "The Internet Archive Wayback Machine Link Fixer plugin for WordPress is vulnerable to improper certificate validation via the snapshot creation request in all versions up to, and including, 1.4.2, due to the request to the Wayback Machine save endpoint being sent with 'sslverify' set to false while it carries the site's archive.org access and secret keys in an Authorization header. This makes it possible for unauthenticated attackers who can intercept traffic between the site and archive.org to impersonate archive.org and capture the site's archive.org API credentials.",
 "plugin": {
  "slug": "internet-archive-wayback-machine-link-fixer",
  "name": "Internet Archive Wayback Machine Link Fixer",
  "full_name": "Internet Archive Wayback Machine Link Fixer",
  "wordpress_org": "https://wordpress.org/plugins/internet-archive-wayback-machine-link-fixer/",
  "advisories_url": "https://wpsec.com/vuln/plugin/internet-archive-wayback-machine-link-fixer/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/internet-archive-wayback-machine-link-fixer"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-295"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.5.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.5.0",
 "remediation": "Update to 1.5.0 or later.",
 "fix_released": "2026-10-20T14:51:06+00:00",
 "published": "2026-10-21T14:52:44+00:00",
 "updated": "2026-10-21T10:35:11.876976+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1385/",
  "https://plugins.svn.wordpress.org/internet-archive-wayback-machine-link-fixer/tags/1.5.0/",
  "https://wordpress.org/plugins/internet-archive-wayback-machine-link-fixer/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/internet-archive-wayback-machine-link-fixer",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}