What is the CVSS score of CVE-2026-16532?

CVE-2026-16532 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Link Library are affected by CVE-2026-16532?

The Link Library WordPress plugin before version 7.9.3 contains a critical SQL injection vulnerability exploitable without authentication.. A patch is available.

Is there a public PoC exploit available for CVE-2026-16532?

Yes, a public proof-of-concept exploit is available for CVE-2026-16532. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16532?

Within 24 hours, audit all WordPress installations and identify which are running the Link Library plugin with version numbers; deactivate and remove the plugin immediately if not in active use. Within 7 days, update all remaining installations of Link Library to version 7.9.3 or later through the WordPress admin panel, verify successful update in plugin settings, and confirm no version rollback occurs. Within 30 days, implement enforced WordPress plugin auto-update policies for security releases, audit database access logs and user activity from the pre-patch week for signs of exploitation, and conduct a database integrity check.

Link Library CVE-2026-16532

EUVD-2026-52165 CRITICAL

SQL Injection (CWE-89)

2026-08-03 WPScan

GHSA-pm7r-7m99-28qp

WordPress SQLi Link Library

9.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated, network-reachable, low-complexity SQL injection (PR:N/AC:L) yields high confidentiality and integrity impact via arbitrary queries; no availability impact, so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:36 vuln.today

CVSS changed

Aug 03, 2026 - 17:37 NVD

9.1 (CRITICAL)

Patch available

Aug 03, 2026 - 07:01 EUVD

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 06:00 cve.org

CRITICAL 9.1

DescriptionCVE.org

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Articles & Coverage 1

News Critical SQL Injection in WordPress Link Library Plugin - CVE-2026-16532 Aug 04, 2026

AnalysisAI

Unauthenticated SQL injection in the Link Library WordPress plugin before 7.9.3 allows remote attackers to inject arbitrary SQL through an unsanitised, unescaped user-supplied value used directly in a database query. Publicly available exploit code exists (published by WPScan), and CISA's SSVC assessment rates the flaw as automatable with total technical impact, though the EPSS probability remains low at 0.18%. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify site running Link Library <7.9.3

Delivery

Send crafted HTTP request with SQL payload

Exploit

Injection executes in backend query

Execution

Extract credentials and sensitive database records

Impact

Exfiltrate or manipulate stored data

Access

Identify site running Link Library <7.9.3

Delivery

Send crafted HTTP request with SQL payload

Exploit

Injection executes in backend query

Execution

Extract credentials and sensitive database records

Impact

Exfiltrate or manipulate stored data

Vulnerability AssessmentAI

Exploitation	Exploitation requires only that a WordPress site have the Link Library plugin installed and active at a version below 7.9.3, with the vulnerable link-handling endpoint reachable over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals partially conflict on urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A remote, unauthenticated attacker sends a crafted HTTP request to a Link Library endpoint, embedding SQL syntax in the vulnerable parameter to extract sensitive data such as WordPress user credentials and session data from the database, or to manipulate stored content. Because publicly available exploit code exists and the attack is automatable (SSVC), an attacker can mass-scan and exploit vulnerable sites with a script requiring no authentication or user interaction.
Remediation	Vendor-released patch: upgrade the Link Library plugin to version 7.9.3 or later, which corrects the sanitisation/escaping of the affected parameter; this is the primary and recommended fix (see the WPScan advisory at https://wpscan.com/vulnerability/da3b8caa-ac99-4097-8286-f3c418ddb63d/ and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-16532). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit all WordPress installations and identify which are running the Link Library plugin with version numbers; deactivate and remove the plugin immediately if not in active use. …

Threat intelligence, references, and detailed analysis are available after sign-in.