CVE-2026-18855: WordPress Link Library Plugin Arbitrary File Deletion

Overview

A critical arbitrary file deletion vulnerability has been discovered in the Link Library plugin for WordPress, assigned CVE-2026-18855 with a CVSS score of 9.1. The flaw allows unauthenticated attackers to delete arbitrary files on the hosting server — up to and potentially including WordPress core files — which can lead to full site compromise or takeover.

The Link Library plugin provides link management functionality for WordPress sites. Insufficient path validation in one of its AJAX-accessible functions exposes servers to this severe vulnerability.

Technical Details

The vulnerability exists in the ll_delete_link_fields function, which handles deletion of link-associated data. The function fails to validate or sanitize the file path parameter before performing file deletion operations, and the endpoint is reachable without authentication.

Attack scenario:

1. An unauthenticated attacker sends a crafted HTTP request to the WordPress site targeting the ll_delete_link_fields AJAX action.
2. The function accepts an arbitrary file path without sanitization or access control validation.
3. The attacker uses path traversal sequences (e.g., ../../) to target files outside the intended plugin directory — including wp-config.php, WordPress core files, or other sensitive server files.
4. Deletion of wp-config.php triggers WordPress's installation wizard on the next visit, allowing the attacker to reconfigure the site with a new database and administrator account (a classic WordPress takeover technique).

Affected Versions

All versions of Link Library up to and including 7.9.4 are vulnerable. The CVE was published August 15, 2026.

Mitigation

• Update Link Library immediately to the patched version available in the WordPress Plugin Repository.
• If updating is not immediately possible, deactivate the plugin to close the attack surface.
• Verify the integrity of critical WordPress files (especially wp-config.php) on affected sites that may have been exposed.
• Implement server-level protections: restrict write/delete permissions on web-accessible directories to the minimum required by WordPress.
• Deploy a WAF rule to block admin-ajax.php requests targeting the ll_delete_link_fields action from unauthenticated sessions.
• Review web server access logs for signs of exploitation, particularly requests with path traversal patterns.

Impact Assessment

The ability to delete arbitrary files without authentication is among the most severe classes of WordPress vulnerabilities. Combined with a path traversal flaw, this can trivially lead to:

• Site takeover via wp-config.php deletion and reinstall
• Data exposure if database credentials or other secrets are accessible
• Defacement or service disruption through deletion of core theme or plugin files

Sites running e-commerce, membership platforms, or any WordPress installation handling sensitive data should treat this as an urgent priority.

References

• NVD: CVE-2026-18855
• WordPress Plugin: Link Library