Link Library WordPress Plugin Arbitrary File Deletion (CVE-2026-18855)

Technical Analysis

CVE-2026-18855 stems from a lack of proper file path sanitization in ll_delete_link_fields, allowing attacker-controlled input to reference arbitrary server file paths. Exploitation requires a non-default configuration (the local file deletion option enabled) and a subsequent admin action deleting the attacker-submitted link, making this a two-stage attack chain rather than a fully unauthenticated single-request exploit. Deleting wp-config.php causes WordPress to enter a setup state, which an attacker can hijack to reconfigure the database connection and achieve remote code execution. The CVSS score of 9.1 reflects the high impact despite the moderate complexity introduced by required admin interaction. Organizations running AI agents or automation tools that manage WordPress content, plugins, or CMS workflows via API keys or admin credentials stored on the same host could see those credentials exposed or agent-driven content pipelines disrupted if the underlying server is compromised via this RCE chain.

Affected Systems

WordPress installations using the Link Library plugin, all versions up to and including 7.9.4, specifically when the 'Delete local file on link deletion' setting is enabled (disabled by default)

Indicators of Compromise

• No specific IOCs published; monitor for anomalous link submissions containing path traversal sequences (../, absolute paths) targeting Link Library endpoints, unexpected deletion of wp-config.php, and unauthorized WordPress setup/installation page access post-deletion

Remediation Steps

1. 1

   Update Plugin

   Upgrade Link Library to the latest patched version beyond 7.9.4 as soon as it is released by the vendor.

2. 2

   Disable Vulnerable Setting

   Turn off the 'Delete local file on link deletion' option in plugin settings unless absolutely necessary.

3. 3

   Audit Link Submissions

   Review pending and recently deleted links for suspicious file paths or traversal patterns before performing moderation actions.

4. 4

   Restrict Admin Actions

   Limit link deletion privileges to trusted administrators and implement a review step before permanent deletion.

5. 5

   Backup Critical Files

   Maintain offline backups of wp-config.php and other critical configuration files for rapid recovery.

6. 6

   Monitor File Integrity

   Deploy file integrity monitoring on core WordPress files to detect unauthorized deletions in real time.