EUVD-2026-59784
GHSA-wm9p-2xmp-4mp2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attacker is unauthenticated (PR:N) but success needs a non-default option enabled and an admin to delete the link (UI:R, AC:H); impact is file deletion so I:H/A:H, no confidentiality loss.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action.
Articles & Coverage 1
AnalysisAI
Arbitrary file deletion in the Link Library WordPress plugin (all versions through 7.9.4) lets unauthenticated attackers submit a malicious link whose crafted path traversal payload causes an arbitrary file on the server to be deleted when an administrator later removes the link; deleting wp-config.php can escalate to remote code execution by dropping WordPress into its setup routine. Reported by Wordfence and fixed in 7.9.5, this issue carries a 9.1 CVSS but has no public exploit identified at time of analysis and is not on CISA KEV, and real exploitation hinges on a non-default plugin option being enabled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the administrator to have enabled the Link Library 'Delete local file on link deletion' option, which is disabled by default, and requires the attacker to be able to submit a link through the plugin's front-end user-submission feature (usersubmission.php). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H = 9.1) rates this as network-reachable, low-complexity and unauthenticated with no user interaction, but this conflicts with the description, which explicitly requires a non-default option ('Delete local file on link deletion') to be enabled AND an administrator to permanently delete the attacker's link - that is both a configuration precondition and human interaction, so the NVD vector overstates real-world ease. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Link Library plugin to version 7.9.5 or later, which is the vendor-released patch (confirmed by WordPress plugin changeset 3646360 and the 7.9.4-to-7.9.5 diff at https://plugins.trac.wordpress.org/changeset?old_path=%2Flink-library/tags/7.9.4&new_path=%2Flink-library/tags/7.9.5). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations running Link Library versions 7.9.4 or earlier and verify whether the non-default plugin option enabling file deletion is active. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today