Overview
CVE-2026-15413 is not a typical security bug. The Link Factory WordPress plugin — marketed as a "homepage sentence publisher" — is an intentional backdoor embedded in a plugin distributed through the WordPress ecosystem. Assigned a CVSS 10.0 score and classified under CWE-912: Hidden Functionality, this vulnerability represents a supply-chain attack targeting any WordPress site that installed the plugin.
WPScan reserved the CVE on July 10, 2026 and it was published on August 13, 2026. There is no patched version because the backdoor is by design.
How the Backdoor Works
The Link Factory plugin registers a REST API namespace at /wp-json/link-factory/v1/. Under this namespace, it exposes multiple operator-controlled endpoints:
Authentication via Ed25519 signature: Incoming requests are authenticated by verifying a detached Ed25519 cryptographic signature against a hardcoded operator public key baked into the plugin source code. Only the party controlling the corresponding private key — the plugin's operator — can issue authenticated commands.
Health check endpoint (unauthenticated): One endpoint, a health check, requires no signature at all. This makes it accessible to anyone with network access to the WordPress site, providing a reliable beacon for the operator to discover active installations.
Scope of operator control: Through the authenticated endpoints, the operator can execute arbitrary operations on any WordPress site running the plugin. The nature of available commands means full control over site content, data, and potentially the underlying server — depending on WordPress configuration and file permissions.
CVSS 10.0 Breakdown
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None (from the operator's perspective, they hold the private key)
- User Interaction: None
- Scope: Changed
- Confidentiality / Integrity / Availability: High / High / High
The maximum possible CVSS score reflects that a remote, unauthenticated (to the WordPress site) operator can achieve complete compromise.
Remediation
There is no patch. The only remediation is complete removal of the plugin:
- Remove the Link Factory plugin immediately from all WordPress installations
- Audit REST API logs for any requests to
/wp-json/link-factory/v1/— if found, treat the site as fully compromised - Conduct a full site audit: Check for unauthorized users, modified files, injected content, or unauthorized post/page changes
- Rotate credentials: WordPress admin passwords, database credentials, and any API keys accessible to the web server
- Consider a full reinstall if exploitation is suspected — a compromised WordPress site cannot be trusted without starting clean
Supply Chain Implications
This CVE is a textbook software supply-chain attack. A malicious actor published a plugin that appears benign on the surface — a "homepage sentence publisher" — while secretly including a persistent backdoor that calls home and awaits operator commands. WordPress site administrators should treat this as a reminder to audit all installed plugins:
- Only install plugins from well-known, actively maintained sources
- Regularly audit installed plugins against current security advisories
- Monitor REST API traffic for unexpected namespaces and endpoints
- Use a Web Application Firewall to block unexpected REST API patterns