CVE-2026-3552 is a missing authorization vulnerability (CWE-862) in the SurfLink – Link Manager & Backup Restore WordPress plugin. The ajax_import_410() AJAX handler function does not perform capability checks (current_user_can()) or nonce verification (check_ajax_referer()), unlike other AJAX handlers in the same class. This flaw allows any authenticated user with at least Subscriber privileges to inject arbitrary URLs into the 410 Gone database table via the surfl_import_410 AJAX action. Consequently, the site will respond with HTTP 410 Gone status for these URLs, which can disrupt legitimate site content availability and negatively impact SEO rankings. The vulnerability affects all versions up to 2.6.0. No official patch or remediation guidance is currently documented.

An attacker with authenticated access at Subscriber level or higher can cause denial of service to legitimate site pages by injecting URLs that return HTTP 410 Gone responses. This can degrade user experience and cause SEO damage through search engine delisting of affected URLs. There is no direct confidentiality or availability impact beyond the denial of service effect on specific URLs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles that have access to the AJAX functionality or disable the plugin if possible. Monitor for plugin updates from the vendor addressing this missing authorization issue.