SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-18855 2026-08-15

CVE-2026-18855: Unauthenticated Arbitrary File Deletion in WordPress Link Library Plugin

"A path traversal flaw in the Link Library plugin for WordPress lets unauthenticated attackers delete arbitrary files on the server, including `wp-config.php`, turning a routine moderation click into a possible path to…"

A path traversal flaw in the Link Library plugin for WordPress lets unauthenticated attackers delete arbitrary files on the server, including wp-config.php, turning a routine moderation click into a possible path to remote code execution.

What Is It

CVE-2026-18855 is an arbitrary file deletion vulnerability (CWE-22, path traversal) in the Link Library plugin for WordPress. The ll_delete_link_fields function performs insufficient file path validation, allowing an attacker-controlled path submitted through the plugin's user link submission feature to be resolved and deleted.

Exploitation is unauthenticated and requires no attacker-side privileges. It does carry two preconditions: the site administrator must have enabled the plugin's "Delete local file on link deletion" option, which is disabled by default, and must subsequently permanently delete the attacker-submitted link. That second step is ordinary moderation work, so on sites where the option is on, the trigger is effectively a matter of time.

Why It Matters

Wordfence rates the issue CVSS 3.1 base score 9.1 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Attack vector is network, attack complexity is low, and no attacker privileges are required. Note that while the vector string scores user interaction as None, the vulnerability does depend on an administrator permanently deleting the attacker-submitted link; an interaction the score does not reflect. Integrity and availability impact are both High.

The practical escalation is the reason for the severity: deleting the right file can open a path to remote code execution. Removing wp-config.php drops a WordPress install back into its setup flow, which could let an attacker point the site at a database they control and take over the installation.

What's Vulnerable

Sites running Link Library with the "Delete local file on link deletion" option disabled are not exploitable through this path, but the option can be toggled on at any time.

Patch Status

The issue is fixed in Link Library 7.9.5. The upstream changeset (WordPress plugin trac 3646360 / 3646361) shows the corrected validation between tags 7.9.4 and 7.9.5. Update to 7.9.5 or later. As an interim measure on unpatched installs, disable the "Delete local file on link deletion" plugin option.

This CVE does not appear in the supplied CISA KEV data; no confirmed active exploitation or federal remediation deadline is recorded in the source material. NVD status is Received (published 2026-08-15), so enrichment such as CPE data is not yet available.

Sources