Link Library EUVD-2026-52165

Exploitation requires only that a WordPress site have the Link Library plugin installed and active at a version below 7.9.3, with the vulnerable link-handling endpoint reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special conditions - remote unauthenticated exploitation against default configurations of Link Library, requiring no authentication and no user interaction. The primary limiting factor is deployment: the target must actually run the affected plugin and version, and the injectable parameter must be exposed to the requester; there is no availability impact, so the attack yields data disclosure/manipulation rather than site takedown.

The signals partially conflict on urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.1) describes an easy, network-reachable, unauthenticated attack with high confidentiality and integrity impact - corroborated by the SSVC framework (Automatable: yes, Technical Impact: total), which argues for prioritisation because the flaw can be scripted at scale. Against that, the EPSS score is only 0.18% (7th percentile), indicating that widespread real-world exploitation has not yet been observed, and the vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation. The presence of publicly available exploit code raises the practical likelihood of opportunistic scanning, but this remains a proof-of-concept signal, not evidence of in-the-wild campaigns. Net assessment: a genuine high-priority patch item for any site running Link Library given the low complexity and public POC, tempered by low current exploitation telemetry and the plugin's modest deployment footprint. Note A:N - availability is not directly impacted, consistent with a data-exfiltration/manipulation SQLi rather than a destructive one.

A remote, unauthenticated attacker sends a crafted HTTP request to a Link Library endpoint, embedding SQL syntax in the vulnerable parameter to extract sensitive data such as WordPress user credentials and session data from the database, or to manipulate stored content. Because publicly available exploit code exists and the attack is automatable (SSVC), an attacker can mass-scan and exploit vulnerable sites with a script requiring no authentication or user interaction.