The WP Links Page plugin for WordPress suffers from a missing capability check in the 'wplf_ajax_update_screenshots' function, enabling authenticated users with low privileges (Subscriber and above) to regenerate link thumbnail images without proper authorization. This vulnerability is tracked as CVE-2024-6465 and is classified under CWE-862 (Missing Authorization). It affects all versions up to and including 4.9.5. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability allows unauthorized modification of link thumbnail images by authenticated users with Subscriber-level access or higher. There is no impact on confidentiality or availability. The integrity impact is low, limited to thumbnail regeneration. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only and monitor for suspicious activity related to link thumbnail updates. Avoid granting Subscriber or higher privileges to untrusted users. Follow vendor communications for updates on patches or official mitigations.