Executive brief
Link Library is a WordPress plugin used to manage and display lists of links. A security flaw allows users with 'Contributor' level access to delete arbitrary files from the web server. This could lead to a complete site outage or the removal of critical configuration files, potentially allowing an attacker to reset the site and take full control.
Technical details
The Link Library plugin for WordPress (versions up to 7.8.8) contains a path traversal vulnerability (CWE-22) that allows authenticated users with Contributor-level privileges to delete arbitrary files on the server. The flaw likely stems from insufficient validation of file paths provided by users in a deletion function. By manipulating input parameters, a remote attacker can bypass directory restrictions to target sensitive system or application files. Successful exploitation results in a denial of service by breaking the website or removing security configurations. The issue is resolved in version 7.8.9.
Affected products
- Link Library Link Library <= 7.8.8
Timeline
- 2026-03-11: other: Reported by researcher Trương Hữu Phúc
- 2026-04-22: advisory: Initial Patchstack advisory published
- 2026-06-15: disclosed: NVD publication date
- 2026-04-22: patched: Version 7.8.9 released to address the vulnerability