Link Library EUVD-2026-86528

Requires an authenticated WordPress user with the Contributor role or higher on a site running the Link Library plugin before version 7.9.6, and the attacker must invoke the plugin's image-generation functionality while supplying an unsanitized destination folder path. Exploitation is LIMITED by: (1) mandatory authentication at Contributor level or above (not unauthenticated despite AV:N); (2) the web server process must have write permission to the targeted path; (3) written files are constrained to numeric names with a fixed image extension, preventing code execution and limiting impact to arbitrary directory creation and image-file write/overwrite outside the document root.

This is a genuinely low-priority issue despite the network attack vector. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) scores only 4.1 (Medium), and multiple independent signals confirm the low urgency: EPSS is 0.16% (4th percentile), it is NOT on the CISA KEV list, and there is no evidence of active exploitation. A public exploit reference exists via WPScan, so publicly available exploit code exists - but POC availability is distinct from active exploitation and does not itself raise the priority here. The impact is deliberately limited: the description confirms only numeric filenames with a fixed image extension can be written, so no executable code (webshell) can be planted, keeping confidentiality and availability impact at none and integrity at low. Note a CONFLICT worth verifying: the input CVSS vector uses PR:H, but the description states exploitation requires only the Contributor role, which is a LOW-privilege authenticated WordPress user - this suggests PR:L is more accurate and the vendor/NVD PR:H rating may understate accessibility. The S:C (scope change) is defensible because files can be written outside the site's document root, affecting resources beyond the vulnerable plugin.

An authenticated attacker (or a compromised/malicious account) holding at least the Contributor role uses the plugin's image-generation feature and supplies a crafted destination folder path containing traversal sequences, causing the web server to create directories and write image files outside the intended plugin directory, including outside the document root. A public POC is referenced by WPScan. Because filenames are forced numeric with an image extension, the attacker can overwrite existing image assets or clutter the filesystem but cannot plant executable code.