# Internet Archive Wayback Machine Link Fixer <= 1.4.2 - Unauthenticated Missing Authorization to archive.org Credential Validation

- **ID:** WPSEC-2026-1386
- **Plugin:** Internet Archive Wayback Machine Link Fixer (`internet-archive-wayback-machine-link-fixer`), https://wordpress.org/plugins/internet-archive-wayback-machine-link-fixer/
- **Affected versions:** all versions before 1.5.0
- **Fixed in:** 1.5.0 (Update to 1.5.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/internet-archive-wayback-machine-link-fixer
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1386/

## Description

The Internet Archive Wayback Machine Link Fixer plugin for WordPress is vulnerable to unauthorized access via the archive.org credential validation routine in all versions up to, and including, 1.4.2, due to a missing capability check in the validate_archive_org_keys() function, which runs on admin_init and acts only on the 'page' and 'settings-updated' query arguments. Because admin_init fires on requests to admin-ajax.php before any login check, this makes it possible for unauthenticated attackers to make the site send its stored archive.org access and secret keys to archive.org for validation as often as they like, and to overwrite the stored credential-validity flag with the result. If those requests fail, for example under rate limiting, the credentials are marked invalid and the site falls back to unauthenticated snapshot mode.

## References

- https://wpsec.com/vuln/WPSEC-2026-1386/
- https://plugins.svn.wordpress.org/internet-archive-wayback-machine-link-fixer/tags/1.5.0/
- https://wordpress.org/plugins/internet-archive-wayback-machine-link-fixer/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1386/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.