What is the CVSS score of EUVD-2026-59784?

EUVD-2026-59784 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 1.2%.

Which versions of Link Library are affected by EUVD-2026-59784?

The Link Library WordPress plugin (versions ≤7.9.4) contains an arbitrary file deletion vulnerability that allows unauthenticated attackers to delete critical server files, including wp-config.php,…

How to fix or mitigate EUVD-2026-59784?

Within 24 hours, inventory all WordPress installations running Link Library versions 7.9.4 or earlier and verify whether the non-default plugin option enabling file deletion is active. Within 7 days, upgrade all affected sites to Link Library version 7.9.5 or disable the plugin entirely. Within 30 days, audit affected WordPress sites for evidence of exploitation such as missing or modified wp-config.php files, verify integrity of critical configuration files, and establish a plugin security patch management process to ensure timely remediation of future vulnerabilities.

Link Library EUVD-2026-59784

| CVE-2026-18855 CRITICAL

Path Traversal (CWE-22)

2026-08-15 security@wordfence.com

GHSA-wm9p-2xmp-4mp2

PHP WordPress RCE Path Traversal

9.1

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

6.8 MEDIUM

Attacker is unauthenticated (PR:N) but success needs a non-default option enabled and an admin to delete the link (UI:R, AC:H); impact is file deletion so I:H/A:H, no confidentiality loss.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 15, 2026 - 19:30 vuln.today

CVE Published

Aug 15, 2026 - 19:16 nvd

CRITICAL 9.1

DescriptionCVE.org

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action.

Articles & Coverage 1

News Critical Arbitrary File Deletion in Link Library WordPress Plugin - CVE-2026-18855 Aug 16, 2026

AnalysisAI

Arbitrary file deletion in the Link Library WordPress plugin (all versions through 7.9.4) lets unauthenticated attackers submit a malicious link whose crafted path traversal payload causes an arbitrary file on the server to be deleted when an administrator later removes the link; deleting wp-config.php can escalate to remote code execution by dropping WordPress into its setup routine. Reported by Wordfence and fixed in 7.9.5, this issue carries a 9.1 CVSS but has no public exploit identified at time of analysis and is not on CISA KEV, and real exploitation hinges on a non-default plugin option being enabled. Impact is integrity and availability loss with a plausible path to full site takeover.

Technical ContextAI

The flaw is a CWE-22 path traversal in the ll_delete_link_fields function of the Link Library plugin, a PHP-based WordPress add-on that lets site owners collect, categorize and display link directories, including a front-end user-submission feature (usersubmission.php). When an administrator deletes a link, the plugin optionally removes an associated local file, but it fails to validate or canonicalize the file path taken from the attacker-controlled submission, allowing '../' sequences to escape the intended upload directory. The referenced source lines (link-library-admin.php around L7865/L7874 and usersubmission.php L52/L476) show the submission-to-deletion data flow that was hardened in changeset 3646360 for the 7.9.5 release. Because WordPress plugins run with the web server's file permissions, deletion of core files such as wp-config.php can force the site into an unconfigured state that an attacker can then re-provision.

RemediationAI

Update the Link Library plugin to version 7.9.5 or later, which is the vendor-released patch (confirmed by WordPress plugin changeset 3646360 and the 7.9.4-to-7.9.5 diff at https://plugins.trac.wordpress.org/changeset?old_path=%2Flink-library/tags/7.9.4&new_path=%2Flink-library/tags/7.9.5). If you cannot upgrade immediately, disable the 'Delete local file on link deletion' plugin option (it is off by default) so that moderating or deleting submitted links no longer triggers filesystem deletion - this removes the attack path at the cost of losing automatic local-file cleanup. As additional compensating controls, restrict or disable anonymous front-end link submissions so untrusted paths cannot be introduced, and ensure the web server user has least-privilege filesystem permissions and a protected wp-config.php (e.g., stored outside the web root) to blunt the RCE escalation. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/41327dfa-db64-476a-a263-7bd4f69fb857 for detection guidance.