CVE-2025-9949 is a CSRF vulnerability in the Internal Links Manager WordPress plugin (up to version 3.0.1). The vulnerability is due to missing or incorrect nonce validation on the link deletion functionality within the process_bulk_action() function. This allows an attacker to cause an authenticated administrator to unknowingly delete SEO links by submitting a forged request, without requiring the attacker to have privileges themselves. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction, and resulting in low impact to integrity without confidentiality or availability impact.

An attacker can cause an authenticated site administrator to delete SEO links by exploiting the CSRF vulnerability. This impacts the integrity of the SEO link data but does not affect confidentiality or availability. There are no known exploits in the wild. The impact is limited to unauthorized modification of link data via administrative actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor is recommended.