CVE-2026-18855criticalCWE-22

CVE-2026-18855: falha crítica em jackdewey Link Library

Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Link Library

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 1.4%
The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
jackdewey · Link Library
CVEs relacionadas — jackdewey Link Library

No mesmo produto, das mais perigosas para as menos.

CVE-2026-116537HIGHLink Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' ParameterEPSS 0.4%CVE-2024-1559MEDIUMLink Library <= 7.6 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-2325MEDIUMLink Library <= 7.6.6 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-15090HIGHLink Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' ParameterEPSS 0.4%CVE-2024-13404MEDIUMLink Library <= 7.7.2 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-4281MEDIUMLink Library <= 7.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via link-library ShortcodeEPSS 0.3%