The Social Link Pages WordPress plugin suffers from a missing capability check in the import_link_pages() function across all versions up to 1.6.9. This missing authorization (CWE-862) enables unauthenticated attackers to inject arbitrary pages and malicious web scripts into the site. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker can exploit this vulnerability to inject arbitrary pages and malicious scripts without authentication, potentially compromising the confidentiality and integrity of the affected WordPress site. This could lead to unauthorized content display, phishing, or further attacks leveraging injected scripts. Availability is not impacted. No known active exploitation has been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official gelform or WordPress plugin channels for updates and apply patches promptly once released.