CVE-2026-18855 is a path traversal vulnerability (CWE-22) in the Link Library WordPress plugin by jackdewey, affecting all versions up to and including 7.9.4. The vulnerability arises from inadequate validation of file paths in the ll_delete_link_fields function, enabling unauthenticated attackers to delete arbitrary files on the server. Exploitation requires that the administrator has enabled the 'Delete local file on link deletion' option and that the attacker-submitted link is permanently deleted, which is a routine moderation task. Deleting sensitive files such as wp-config.php can lead to remote code execution. The CVSS 3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on integrity and availability. No official patch or remediation level has been published yet.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable plugin if the 'Delete local file on link deletion' option is enabled by an administrator. This can result in denial of service or remote code execution if critical files like wp-config.php are deleted. The impact on integrity and availability is high, but confidentiality is not affected. The vulnerability requires a specific plugin option to be enabled and a routine moderation action to be performed, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should ensure that the 'Delete local file on link deletion' option remains disabled (it is disabled by default) to prevent exploitation. Additionally, exercise caution when permanently deleting links submitted by untrusted users. Monitor vendor communications for updates and apply any official fixes promptly once released.