CVE-2026-3552 surflabtech CVE debrief

Who should care

WordPress users with the SurfLink - Ultimate Link Manager plugin installed should be aware of this vulnerability and take steps to protect their sites. This includes updating the plugin to the latest version, implementing additional authentication and authorization checks for AJAX handlers, and monitoring site activity for suspicious URL imports. Site administrators and security teams should review the plugin's AJAX handlers and check for proper authorization and nonce checks to prevent similar vulnerabilities.

Technical summary

The SurfLink - Ultimate Link Manager plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the ajax_import_410() function in all versions up to 2.6.0. This is due to a missing capability check (current_user_can()) and missing nonce verification (check_ajax_referer()) in the ajax_import_410() function, while all other AJAX handlers in the same class properly implement both authorization and nonce checks. The vulnerability allows authenticated attackers with Subscriber-level access and above to import arbitrary URLs into the 410 Gone database table via the surfl_import_410 AJAX action.

Defensive priority

Medium

Recommended defensive actions

• Update the SurfLink - Ultimate Link Manager plugin to the latest version.
• Implement additional authentication and authorization checks for AJAX handlers.
• Monitor site activity for suspicious URL imports.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is due to a missing capability check (current_user_can()) and missing nonce verification (check_ajax_referer()) in the ajax_import_410() function. This allows authenticated attackers with Subscriber-level access and above to import arbitrary URLs into the 410 Gone database table via the surfl_import_410 AJAX action. Injected URLs will cause the site to return HTTP 410 Gone responses to all visitors accessing those paths, potentially causing denial of service for legitimate pages and SEO damage through search engine delisting. The SurfLink - Ultimate Link Manager plugin for WordPress has a vulnerability that allows authenticated attackers with Subscriber-level access and above to import arbitrary URLs into the 410 Gone database table. To verify, defenders should review the plugin's AJAX handlers and check for proper authorization and nonce checks.

Official resources