CVE-2026-3552 describes a missing authorization vulnerability (CWE-862) in the SurfLink – Link Manager & Backup Restore WordPress plugin. The ajax_import_410() AJAX handler does not perform capability checks (current_user_can()) or nonce verification (check_ajax_referer()), unlike other AJAX handlers in the same class. This flaw enables authenticated users with low privileges (Subscriber and above) to inject arbitrary URLs into the 410 Gone table, causing those URLs to return HTTP 410 Gone responses site-wide. This can disrupt normal site operation by denying access to legitimate pages and negatively impacting search engine indexing.

An attacker with authenticated access at Subscriber level or higher can cause denial of service to legitimate site pages by injecting URLs that return HTTP 410 Gone responses. This can lead to SEO damage due to search engines delisting affected URLs. There is no direct confidentiality or availability impact beyond the denial of service effect on specific URLs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should restrict plugin usage to trusted users and monitor for suspicious AJAX activity related to the surfl_import_410 action. Applying principle of least privilege to user roles may reduce risk.