CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-18855 — The Link Library plugin for WordPress is vulnerable to arbitrary file deletion d...

·Source: NIST NVD

Updated:

Executive Summary

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). E

Analysis

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action. CVSS Score: 9.1. Published: 2026-08-15T19:16:32.160.

Indicators of Compromise (1)

CVE (1)
CVE-2026-18855
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 15, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

We Reviewed 80,300 Healthcare Review Replies. The HIPAA Risk Was Hiding in Plain Sight

A two-stage review of 4,019 medical and dental practices found an estimated 21,117 public replies that met a conservative patient-information […] The post We Reviewed 80,300 Healthcare Review Replies. The HIPAA Risk Was Hiding in Plain Sight appeared first on The HIPAA Journal .

HIPAA Journal
MEDIUMVulnerabilityNEW

Dozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates

The bugs could be exploited to crash Safari, corrupt memory, leak sensitive data, escape the sandbox, and exfiltrate data. The post Dozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-15748 — The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload...

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler th

CVE-2026-15748
NIST NVD