CVE-2026-18855: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in jackdewey Link Library
The Link Library plugin for WordPress contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient validation of file paths in the ll_delete_link_fields function in all versions up to and including 7.9.4. Exploitation requires the plugin option 'Delete local file on link deletion' to be enabled (disabled by default) and an attacker-submitted link to be permanently deleted by an administrator. Successful exploitation can lead to remote code execution if critical files such as wp-config.php are deleted.
AI Analysis
Technical Summary
CVE-2026-18855 is a path traversal vulnerability (CWE-22) in the Link Library WordPress plugin by jackdewey. The vulnerability arises from insufficient file path validation in the ll_delete_link_fields function, allowing unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution when important files are deleted. Exploitation requires the 'Delete local file on link deletion' option to be enabled and an administrator to permanently delete a maliciously crafted link. All versions up to and including 7.9.4 are affected.
Potential Impact
An attacker can delete arbitrary files on the server without authentication if the vulnerable plugin option is enabled and an administrator deletes the attacker-submitted link. This can result in denial of service or remote code execution if critical files like wp-config.php are removed.
Mitigation Recommendations
No official patch or remediation level is currently confirmed. The vulnerability requires the 'Delete local file on link deletion' option to be enabled, which is disabled by default. Administrators should ensure this option remains disabled until a fix is available. Monitor vendor advisories for updates and apply patches once released.
CVE-2026-18855: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in jackdewey Link Library
Description
The Link Library plugin for WordPress contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient validation of file paths in the ll_delete_link_fields function in all versions up to and including 7.9.4. Exploitation requires the plugin option 'Delete local file on link deletion' to be enabled (disabled by default) and an attacker-submitted link to be permanently deleted by an administrator. Successful exploitation can lead to remote code execution if critical files such as wp-config.php are deleted.
CVSS v3.1
Score 9.1critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18855 is a path traversal vulnerability (CWE-22) in the Link Library WordPress plugin by jackdewey. The vulnerability arises from insufficient file path validation in the ll_delete_link_fields function, allowing unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution when important files are deleted. Exploitation requires the 'Delete local file on link deletion' option to be enabled and an administrator to permanently delete a maliciously crafted link. All versions up to and including 7.9.4 are affected.
Potential Impact
An attacker can delete arbitrary files on the server without authentication if the vulnerable plugin option is enabled and an administrator deletes the attacker-submitted link. This can result in denial of service or remote code execution if critical files like wp-config.php are removed.
Mitigation Recommendations
No official patch or remediation level is currently confirmed. The vulnerability requires the 'Delete local file on link deletion' option to be enabled, which is disabled by default. Administrators should ensure this option remains disabled until a fix is available. Monitor vendor advisories for updates and apply patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-08-04T15:58:36.475Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a80b2e7bf8831d5398a3056
Added to database: 08/15/2026, 18:41:43 UTC
Last enriched: 08/15/2026, 18:56:06 UTC
Last updated: 08/15/2026, 19:01:03 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.