CVE-2026-66464

CVE-2026-66464 scores 6.5 (medium) for broken access control in Internal Link Optimizer 5.2.7, a WordPress plugin that manages content linking relationships. The EPSS score of 0.00194 reinforces the medium classification. Ignore both numbers at your peril. The CVSS model systematically underweights unauthenticated access control failures because it measures technical impact (data exposure) rather than exploitation barrier collapse. No authentication means any internet-connected actor can probe the endpoint — there's no credential theft, no phishing, no foothold required. That's a fundamentally different risk profile than an authenticated vulnerability scoring higher. The 6.5 score reflects what an attacker gets, not how easy it is to get there. This matters especially for this plugin. Internal Link Optimizer controls your site's content relationship graph — the structure that connects posts, determines navigation flow, and powers internal link suggestions. Broken access control here isn't exposing a single data field; it's giving an unauthenticated actor the ability to inject, modify, or sever internal links across your entire site. That can redirect traffic, poison SEO through malicious outbound links, or establish persistence that survives credential resets. CVSS can't model chained exploits, but attackers do this routinely. The low EPSS score compounds the danger. Low exploitation probability typically means no public tooling yet — not that attackers aren't interested. You're in the highest-value window: defenders deprioritizing based on the score, no one watching, exploit code eventually materializing. Historical pattern is clear: unauthenticated WordPress plugin vulnerabilities scoring medium reliably follow a three-phase lifecycle — disclosure scores 6.5, exploit tooling appears within 90-180 days, then the CVE gets retrospectively discussed as obviously critical. Prioritize this regardless of the CVSS number. If the plugin is unmaintained or on a slow update cadence, treat the 6.5 as actively dangerous — the remediation window may be closing while the score falsely reassures. Check whether internal linking functions require authentication, verify the plugin's maintenance status, and monitor for any public exploit development. The score tells you what happened; the risk profile tells you what will happen.

Reviewed through automated stages and approved by a human before publication.