EUVD-2026-57747
GHSA-p2hj-vx9x-4rh8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Operator reaches the backdoor over the network with no WordPress auth or interaction; scope changes to the host and impact is total, though privileged use is gated by the operator's Ed25519 key.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).
Articles & Coverage 1
AnalysisAI
Full site compromise in the Link Factory WordPress plugin stems from the plugin itself being a deliberate backdoor rather than a coding flaw. Marketed as a 'homepage sentence publisher', it silently exposes an operator-controlled REST API under /wp-json/link-factory/v1/ that grants the plugin's author covert command-and-control over any site that installs it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The required condition is deployment of the malicious Link Factory plugin on the WordPress site; once installed and active, the operator endpoints under /wp-json/link-factory/v1/ are reachable remotely with no WordPress authentication and no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) scores a maximal 10.0, and for a backdoor this is credible: the operator reaches the site over the network, with low complexity, no WordPress credentials, no user interaction, a changed scope (the backdoor can affect the whole host beyond the plugin), and full confidentiality/integrity/availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A site owner installs Link Factory believing it publishes homepage sentences; the operator, using their private key, signs requests to /wp-json/link-factory/v1/ and issues commands that read data, alter content, or plant further persistence with full privileges. A public POC exists, and given AV:N/AC:L the operator's requests succeed remotely with no site login and no complexity barrier. … |
| Remediation | Because the plugin is itself a backdoor, the fix is not a patch but complete removal: deactivate and delete the Link Factory plugin from every affected WordPress installation immediately, then treat the site as compromised. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all WordPress deployments to identify Link Factory plugin installations and immediately remove or disable the plugin; block its installation via WordPress package management and security controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-912 – Hidden Functionality
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today