The Linksy Search and Replace plugin for WordPress contains a critical authorization flaw that allows authenticated attackers to escalate their privileges to administrator status.

This vulnerability stems from a missing capability check in the linksy_search_and_replace_item_details function (CWE-862). Authenticated users with subscriber-level access can manipulate database tables, including the wp_capabilities field, to grant themselves administrative privileges.

This vulnerability carries a CVSS score of 8.8, reflecting its high severity as it permits complete site takeover. Successful exploitation grants an attacker full administrative control over the WordPress instance, leading to total compromise of site data, potential malware injection, and unauthorized access to underlying server resources.

Immediate Action: As no patched version is currently confirmed, administrators should immediately deactivate and remove the Linksy Search and Replace plugin from all WordPress installations until a vendor-supplied update is verified.

Proactive Monitoring: Review WordPress user account logs and audit database modifications for suspicious changes to the wp_capabilities field or unexpected creation of new administrator accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the affected AJAX endpoint, though removal remains the only absolute mitigation.

Public Exploit Available: Unknown.

Given the severity of the privilege escalation risk, organizations must prioritize the removal of the Linksy Search and Replace plugin. Because this vulnerability allows an attacker to achieve full administrative control, the risk of total data loss and site defacement is extreme. Please monitor the vendor's official plugin page for security updates and only re-enable the functionality once a verified patch has been deployed.