External risk intelligence

Link Factory WordPress Plugin Backdoor via Unauthenticated REST API

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-15413

The vulnerability exists within a WordPress plugin that exposes a REST API endpoint accessible via the public internet as part of its standard functionality. Because WordPress sites are typically deployed as public-facing web services, this endpoint is directly reachable by external users by design.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in the Link Factory WordPress plugin, which operates as a backdoor. The plugin exposes a hardcoded, operator-controlled REST API that can be accessed remotely, posing a significant security risk. The main concern is to confirm if this plugin is in use and assess potential exposure.

Backdoor plugin creates hidden remote access.
Critical flaw allows unauthorized control.
Confirm plugin use and assess risk.

Attack Path

How an attacker could exploit the issue

An attacker could target a WordPress site using the vulnerable plugin. By sending a specially crafted request to the plugin's REST API endpoint, an attacker could potentially execute arbitrary code on the server, leading to a complete compromise of the website and its underlying infrastructure.

Unauthenticated network access required.
Trigger via crafted REST API requests.
Full system compromise risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact WordPress sites using the Link Factory plugin by allowing unauthorized access to its operator-controlled REST API. When successfully exploited, this could lead to the exposure or modification of sensitive information, or disruption of service.

System data and service integrity at risk.
Unauthenticated network access to REST API.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Link Factory WordPress plugin allows for unauthenticated remote code execution via a hardcoded public key. Technical leaders and security teams should prioritize identifying all instances of this plugin, assessing their exposure, and determining the accountable owner for remediation. Immediate steps should focus on confirming the presence and reachability of the plugin across the organization's WordPress footprint.

WordPress administrators and security teams own remediation.
Verify plugin presence and public accessibility first.
Plan for vendor coordination and plugin removal.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Link Factory WordPress plugin?

Link Factory is a WordPress plugin marketed as a tool for publishing homepage sentences. Beneath this function, it embeds a hidden mechanism that provides remote access to the server, operating effectively as a backdoor. By installing this plugin, site owners inadvertently introduce an external interface that grants an outside operator control over the web server's resources.

Why is CVE-2026-15413 considered a critical backdoor?

This vulnerability represents a deliberate design flaw where the plugin includes a hardcoded public key to verify incoming requests. Because the plugin does not require valid administrative credentials to interact with its REST API, it allows unauthorized parties to bypass standard security checks and execute commands on the host system.

How is the Link Factory backdoor triggered?

The vulnerability is triggered by sending a specific request to the plugin’s REST API endpoint, located at /wp-json/link-factory/v1/. While the plugin verifies signatures for most actions, the health check feature is an exception that does not require authentication. Accessing any other endpoint or functionality outside of these intended checks initiates the malicious pathway.

Is my WordPress site at risk from this vulnerability?

If you are using the Link Factory plugin, your site is at high risk. According to Halo Surface Signal, because WordPress sites are typically deployed as public-facing services, the plugin's REST API endpoint is designed to be reachable over the internet. This means an attacker does not need internal network access to reach the vulnerable component; the risk is present for any site with the plugin active and accessible online.

What steps should I take to address CVE-2026-15413?

Your priority is to identify every WordPress instance in your environment where Link Factory is installed. Once identified, verify if the plugin is currently active and reachable from the internet. Plan to remove the plugin immediately, as it is inherently malicious, and coordinate with your technical teams to ensure all traces of the software are fully purged from your WordPress infrastructure.

References

wpscan.com/vulnerability/4cad269d-0146-4ca9-a1ae-55f02c8e5433/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.