WordPress Link Library plugin: unauthenticated file deletion can lead to RCE
Link Library WordPress plugin (≤7.9.4) allows unauthenticated arbitrary file deletion — including wp-config.php — which can lead to remote code execution when the admin delete-local-file option is enabled.
- Vendor
- Link Library
- Product
- Link Library WordPress Plugin (all versions through 7.9.4)
- CVSS
- 9.1
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
The ll_delete_link_fields function in Link Library versions through 7.9.4 performs insufficient file path validation when removing local files associated with deleted links. An unauthenticated attacker can supply arbitrary file paths and delete files on the web server.
Conditional scope: exploitation of the RCE pathway requires an administrator to have enabled the “Delete local file on link deletion” setting, which is off by default. With that option active, deleting wp-config.php exposes the WordPress re-install flow, which an attacker can use to set new admin credentials and achieve full site takeover.
Affected versions: All Link Library releases through 7.9.4.
Patch: Update Link Library to the latest available version via the WordPress plugin directory. As an immediate interim measure, confirm whether “Delete local file on link deletion” is enabled in your installation and disable it if not explicitly needed — this eliminates the RCE pathway regardless of patch status.
NVD record: CVE-2026-18855
