CVE-2026-15413 identifies a critical backdoor in the Link Factory WordPress plugin, which masquerades as a homepage sentence publisher. The plugin exposes a REST API endpoint at /wp-json/link-factory/v1/ that is authenticated using a detached Ed25519 signature checked against a hardcoded operator public key. This design effectively grants the operator full control over the affected WordPress instance without requiring standard authentication. The vulnerability is categorized under CWE-912 (Hidden Functionality). The CVSS 3.1 base score is 10, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time.

An unauthenticated remote attacker can leverage the hidden backdoor REST API to gain full control over the WordPress site running the Link Factory plugin. This results in complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability allows execution of arbitrary commands or actions controlled by the attacker, effectively bypassing all normal security controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to remove or disable the Link Factory plugin to eliminate the backdoor risk. Monitor for updates from the vendor or trusted security sources regarding patches or mitigations.