{
 "id": "WPSEC-2026-1386",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1386/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1386/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1386/index.md",
 "title": "Internet Archive Wayback Machine Link Fixer <= 1.4.2 - Unauthenticated Missing Authorization to archive.org Credential Validation",
 "description": "The Internet Archive Wayback Machine Link Fixer plugin for WordPress is vulnerable to unauthorized access via the archive.org credential validation routine in all versions up to, and including, 1.4.2, due to a missing capability check in the validate_archive_org_keys() function, which runs on admin_init and acts only on the 'page' and 'settings-updated' query arguments. Because admin_init fires on requests to admin-ajax.php before any login check, this makes it possible for unauthenticated attackers to make the site send its stored archive.org access and secret keys to archive.org for validation as often as they like, and to overwrite the stored credential-validity flag with the result. If those requests fail, for example under rate limiting, the credentials are marked invalid and the site falls back to unauthenticated snapshot mode.",
 "plugin": {
  "slug": "internet-archive-wayback-machine-link-fixer",
  "name": "Internet Archive Wayback Machine Link Fixer",
  "full_name": "Internet Archive Wayback Machine Link Fixer",
  "wordpress_org": "https://wordpress.org/plugins/internet-archive-wayback-machine-link-fixer/",
  "advisories_url": "https://wpsec.com/vuln/plugin/internet-archive-wayback-machine-link-fixer/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/internet-archive-wayback-machine-link-fixer"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.5.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.5.0",
 "remediation": "Update to 1.5.0 or later.",
 "fix_released": "2026-10-20T14:51:06+00:00",
 "published": "2026-10-21T14:52:44+00:00",
 "updated": "2026-10-21T10:35:11.876976+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1386/",
  "https://plugins.svn.wordpress.org/internet-archive-wayback-machine-link-fixer/tags/1.5.0/",
  "https://wordpress.org/plugins/internet-archive-wayback-machine-link-fixer/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/internet-archive-wayback-machine-link-fixer",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}