CVE-2026-16532 is a SQL injection vulnerability in the Link Library WordPress plugin versions prior to 7.9.3. The flaw arises because the plugin fails to properly sanitize and escape user input before using it in SQL queries. This allows unauthenticated attackers to inject malicious SQL code, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity with network attack vector, no privileges required, and no user interaction needed. No official fix or patch has been documented yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability allows unauthenticated attackers to perform SQL injection attacks against the WordPress database used by the Link Library plugin. This can result in unauthorized disclosure and modification of sensitive data, impacting confidentiality and integrity. Availability impact is not indicated. The critical CVSS score reflects the high potential impact and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Link Library plugin if possible or restricting access to the affected functionality. Monitor vendor channels for updates and apply patches promptly once available.