Description

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-15T19:16:32.160Z",
  "pubdate": "2026-08-15T19:16:32.160Z",
  "executiveSummary": "An arbitrary file deletion vulnerability exists in the Link Library plugin for WordPress in all versions up to, and including, 7.9.4. The flaw resides within the ll_delete_link_fields function, which suffers from insufficient file path validation. This security deficiency allows unauthenticated attackers to supply malicious parameters targeting arbitrary files residing on the host server.\nThe primary impact of this vulnerability is the unauthorized removal of critical system or application files, which can directly facilitate escalation to remote code execution. For instance, the deletion of core configuration files such as wp-config.php can force a reinstallation state or permit database takeover and application compromise.\nSuccessful exploitation requires specific preconditions: an administrator must have explicitly enabled the 'Delete local file on link deletion' plugin option, which remains disabled by default, and must subsequently perform a routine moderation action to permanently delete the attacker-submitted link. Despite requiring administrative interaction via moderation, the attack vector remains highly dangerous due to the severity of the potential post-exploitation impact.",
  "technicalDetails": "The vulnerability stems from improper input sanitization and a lack of rigorous file path validation within the ll_delete_link_fields function of the Link Library plugin. Affected versions include all iterations up to, and including, 7.9.4. The component fails to adequately verify or restrict the file paths supplied during link deletion operations, enabling path traversal or absolute path referencing.\nThe attack flow begins when an unauthenticated attacker submits a crafted link input containing malicious path parameters to the vulnerable application endpoint. Because the application accepts this untrusted input without sufficient validation, it queues the referenced file path for deletion when the associated link object is processed.\nThe exploitation mechanism relies on a multi-stage process involving administrative interaction. The unauthenticated attacker first submits the payload via the plugin interface. Subsequently, an administrator executes a routine moderation action to permanently delete the submitted link. During this deletion routine, the ll_delete_link_fields function processes the stored payload and triggers the file system deletion operation against the targeted absolute or relative file path.\nThe post-exploitation impact is severe. By targeting critical application files such as wp-config.php, attackers can disrupt service availability, bypass authentication mechanisms, or induce application reinstallation states that facilitate arbitrary code execution and full server compromise. The vulnerability is network-exposed via the plugin's submission interface and requires no initial privileges or authentication to initiate the payload submission phase."
}