Link Library CVE-2026-15090

The injection is reachable through the plugin's front-end link user-submission functionality (the patch touches usersubmission.php), via the 'link_url' parameter in Link Library ≤ 7.9.2. No authentication is required (PR:N) and no user interaction (UI:N), making default-exposed submission forms directly attackable over the network. Practical limiting factors: the attack is a TIME-BASED BLIND injection, so extraction is slow and requires many timed requests, and exploitation realistically depends on the site having the Link Library user-submission form enabled and publicly accessible - sites that do not expose that feature reduce their exposure.

This is a moderate-priority issue rather than a top-tier emergency, despite the 7.5 CVSS and unauthenticated vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated flaw, which raises its baseline concern, and the scope is bounded to confidentiality (C:H/I:N/A:N) - consistent with a blind SQL injection used to read database contents (e.g., credentials, hashes, secrets) but not directly modify data or cause denial of service. However, the exploitation technique is explicitly time-based blind SQL injection, which is slow and noisy to weaponize for bulk extraction, tempering the real-world impact relative to a direct/UNION-based leak. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is referenced - so there is no evidence of active exploitation or widespread automated attacks at this time. The patch exists (fixed in 7.9.3 per the WordPress plugin trac changeset), and Wordfence (a credible WordPress security vendor) is the reporter, lending confidence to the technical validity. Net: a legitimately exploitable unauthenticated SQLi worth prompt patching on affected sites, but current signals suggest opportunistic rather than mass or targeted exploitation.

A remote, unauthenticated attacker submits crafted input in the 'link_url' parameter to the plugin's user-submission endpoint, injecting a time-based blind SQL payload (e.g., conditional SLEEP) into the unprepared query. By observing response-time differences, the attacker iteratively extracts sensitive data such as WordPress user credentials or secret keys from the database. No public exploit code is referenced, so an attacker would need to craft the payload manually.