CVE-2026-18855: Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter
The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Link Libraryto a version that resolves this vulnerability.Fixed in 7.9.4 - Compensating control
Ensure the Link Library WordPress plugin option 'Delete local file on link deletion' remains disabled (it is disabled by default) to reduce the risk of arbitrary file deletion via link_url.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18855?
CVE-2026-18855 has a severity rating of 9.1, classified as critical.
How do I fix CVE-2026-18855?
To mitigate CVE-2026-18855, update the Link Library plugin for WordPress to version 7.9.5 or later.
What type of vulnerability is CVE-2026-18855?
CVE-2026-18855 is classified as a path traversal vulnerability allowing arbitrary file deletion.
Who is affected by CVE-2026-18855?
CVE-2026-18855 affects all versions of the Link Library plugin for WordPress up to and including 7.9.4.
What can attackers do using CVE-2026-18855?
Attackers can exploit CVE-2026-18855 to delete arbitrary files on the server without authentication.