CVE-2026-18855criticalCWE-22

CVE-2026-18855: critical vulnerability in jackdewey Link Library

Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter

Published · Updated

Follow this CVE+ Monitor Link Library

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 1.4%
The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected products
jackdewey · Link Library
Related CVEs — jackdewey Link Library

In the same product, most dangerous first.

CVE-2026-116537HIGHLink Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' ParameterEPSS 0.4%CVE-2024-1559MEDIUMLink Library <= 7.6 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-2325MEDIUMLink Library <= 7.6.6 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-15090HIGHLink Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' ParameterEPSS 0.4%CVE-2024-13404MEDIUMLink Library <= 7.7.2 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-4281MEDIUMLink Library <= 7.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via link-library ShortcodeEPSS 0.3%