Description

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-13T09:17:12.153Z",
  "pubdate": "2026-08-13T09:17:12.153Z",
  "executiveSummary": "The Link Factory WordPress plugin functions as a deliberate backdoor distributed under the guise of a homepage sentence publisher. The vulnerability type is an unauthorized administrative control interface and remote backdoor access mechanism. The impact of this security flaw allows an external attacker possessing the corresponding private key to execute arbitrary operations or commands via the exposed API endpoints. The affected system is the Link Factory WordPress plugin. The risk implications are severe, granting complete compromise of the underlying WordPress installation to unauthorized third parties. Attacker capabilities include interacting with the operator-controlled REST API to publish, modify, or manage site content and execute backend routines without legitimate administrator credentials. Exploitation requirements include network access to the target WordPress instance and a valid detached Ed25519 signature generated by the hardcoded operator private key, bypassing standard authentication checks for all endpoints except the health check.",
  "technicalDetails": "The root cause of the vulnerability is the inclusion of hardcoded cryptographic verification materials combined with an undocumented, attacker-controlled administrative interface within the plugin codebase. The vulnerable component is the REST API routing mechanism exposed under the /wp-json/link-factory/v1/ URI path. Network exposure is global, as the REST API endpoints are publicly accessible over HTTP and HTTPS protocols to any client capable of reaching the WordPress site. Authentication requirements are bypassed through a custom cryptographic scheme rather than native WordPress session management. Instead of traditional credentials, incoming requests are authenticated via a detached Ed25519 signature that is verified against a hardcoded operator public key embedded directly within the plugin files. Privilege requirements are effectively non-existent for external actors who hold the corresponding private key, as successful cryptographic verification grants operator-level control over the exposed API functionality. The payload behavior centers around servicing requests submitted to the /wp-json/link-factory/v1/ namespace, allowing the remote operator to manage sentences or execute publisher functions covertly. The attack flow proceeds as follows: First, the attacker crafts a malicious HTTP request destined for the exposed REST API routes under /wp-json/link-factory/v1/. Second, the attacker appends a detached Ed25519 signature to the request headers or parameters, signing the payload or request data using the private key corresponding to the hardcoded public key compiled into the plugin. Third, the plugin intercepts the request and routes it to the internal verification handler, bypassing standard WordPress authentication hooks. Fourth, the plugin routine validates the detached Ed25519 signature against the hardcoded operator public key. Fifth, upon successful cryptographic verification, the plugin processes the request and executes the operator-controlled instructions, except in the case of the unauthenticated health check endpoint. Post-exploitation impact includes persistent unauthorized control over the homepage content, potential injection of malicious links or scripts into the website visitors' browsers, and potential escalation depending on the full scope of functions exposed by the backdoor API."
}