CVE-2026-78395: Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass
The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Link Library WordPress pluginto a version that resolves this vulnerability.Fixed in 7.10.0
Event History
Frequently Asked Questions
What must an attacker obtain to bypass the login requirement?
The attacker needs a front-end form token from a different library that allows submissions without login. They can then reuse that token to submit a link to a library configured to require login.
Which configurations are exposed?
The issue affects sites where a login-required library accepts front-end link submissions and another library provides an unauthenticated submission form from which a token can be obtained. A library that requires login alone is not described as sufficient for exploitation.
How can I determine whether my site may be affected?
Check whether the plugin version is earlier than 7.10.0, whether any library requires login for link submissions, and whether another library permits unauthenticated front-end submissions. That combination matches the described attack path.