CVE-2026-78396: Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure
The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Link Library WordPress pluginto a version that resolves this vulnerability.Fixed in 7.10.0
Event History
Frequently Asked Questions
Which installations are affected?
Link Library versions earlier than 7.10.0 are affected. Exposure is relevant where links contain telephone numbers, e-mail addresses, or submitter names that a settings set is configured not to display.
Does an attacker need an account to retrieve the hidden information?
No. The issue can be exploited by unauthenticated users.
What data can be exposed?
An attacker may disclose telephone numbers, e-mail addresses, and submitter names stored with links, even when the selected settings set is configured to hide those fields.