Internet Archive Wayback Machine Link Fixer <= 1.4.2 - Unauthenticated Missing Authorization to archive.org Credential Validation
- ID
- WPSEC-2026-1386
- Plugin
- Internet Archive Wayback Machine Link Fixer (internet-archive-wayback-machine-link-fixer)
- Affected
- all versions before 1.5.0
- Remediation
- Update to 1.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- Internet Archive Wayback Machine Link Fixer on WPSec AttackSurface
- Fix released
- Published
Description
The Internet Archive Wayback Machine Link Fixer plugin for WordPress is vulnerable to unauthorized access via the archive.org credential validation routine in all versions up to, and including, 1.4.2, due to a missing capability check in the validate_archive_org_keys() function, which runs on admin_init and acts only on the 'page' and 'settings-updated' query arguments. Because admin_init fires on requests to admin-ajax.php before any login check, this makes it possible for unauthenticated attackers to make the site send its stored archive.org access and secret keys to archive.org for validation as often as they like, and to overwrite the stored credential-validity flag with the result. If those requests fail, for example under rate limiting, the credentials are marked invalid and the site falls back to unauthenticated snapshot mode.
References
- https://wpsec.com/vuln/WPSEC-2026-1386/
- https://plugins.svn.wordpress.org/internet-archive-wayback-machine-link-fixer/tags/1.5.0/
- https://wordpress.org/plugins/internet-archive-wayback-machine-link-fixer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS