Link Factory CVE-2026-15413

The required condition is deployment of the malicious Link Factory plugin on the WordPress site; once installed and active, the operator endpoints under /wp-json/link-factory/v1/ are reachable remotely with no WordPress authentication and no user interaction. The key limiting factor is the Ed25519 signature check: privileged operations require a request signed with the operator's private key verified against the hardcoded operator public key, so exploitation of the privileged functions is restricted to the operator (or a holder of that private key) - not to arbitrary unauthenticated internet attackers. The only genuinely open surface is the health-check endpoint, which is intentionally unauthenticated and usable by anyone to fingerprint affected hosts.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) scores a maximal 10.0, and for a backdoor this is credible: the operator reaches the site over the network, with low complexity, no WordPress credentials, no user interaction, a changed scope (the backdoor can affect the whole host beyond the plugin), and full confidentiality/integrity/availability impact. A crucial nuance: PR:N is scored from the perspective of the plugin's operator, who bypasses WordPress authentication entirely - but the privileged REST endpoints are cryptographically gated by an Ed25519 signature, so an arbitrary third-party attacker cannot invoke them without the operator's private key. This means the practical threat is the plugin author (or anyone who obtains that private key), not opportunistic internet-wide scanning of the signed endpoints. EPSS and KEV data were not provided, so widespread automated exploitation is neither confirmed nor ruled out; POC availability confirms the backdoor mechanism is public. The unauthenticated health-check endpoint does expose the site to trivial detection by any party. Net assessment: a genuine critical-priority issue for any site running it, but the risk is targeted (operator-controlled) rather than mass-exploitable by the general attacker population.

A site owner installs Link Factory believing it publishes homepage sentences; the operator, using their private key, signs requests to /wp-json/link-factory/v1/ and issues commands that read data, alter content, or plant further persistence with full privileges. A public POC exists, and given AV:N/AC:L the operator's requests succeed remotely with no site login and no complexity barrier. Separately, any third party can hit the unauthenticated health-check endpoint to enumerate which sites are running the backdoor.