External risk intelligence

WordPress Link Library File Deletion Leads to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-18855

The vulnerability resides in a WordPress plugin. WordPress sites are web-based applications frequently exposed to the public internet. While the specific attack requires a non-default configuration, the underlying product role is that of a public-facing web service, making internet-reachable exploitation a standard deployment scenario.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the WordPress Link Library plugin allows unauthenticated attackers to delete arbitrary files on the server. This could potentially lead to remote code execution if critical files are targeted. Exploitation requires a specific plugin setting to be enabled and a subsequent moderation action by an administrator.

Plugin flaw lets attackers delete server files.
Attackers could gain control of systems.
Confirm plugin usage and its configuration.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can initiate the attack by submitting a link, which, if later deleted by an administrator with a specific plugin option enabled, can lead to arbitrary file deletion. This could result in the deletion of critical files like `wp-config.php`, potentially allowing remote code execution on the server.

No authentication required.
Deleting a submitted link with option enabled.
Arbitrary file deletion leading to RCE.

Live Threat

Current exploitation, exposure, and threat context

When the "Delete local file on link deletion" option is enabled and an administrator deletes an attacker-submitted link, arbitrary files on the server could be deleted. This could potentially lead to remote code execution if critical files like `wp-config.php` are targeted.

Server files could be deleted.
Unauthenticated attackers could trigger deletions.
Remote code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WordPress administrator and the platform team are likely responsible for managing this vulnerability. The first practical move is to identify all WordPress instances, determine if the 'Delete local file on link deletion' option is enabled, and confirm the plugin's version. Then, assess business criticality and confirm the accountable owner before planning remediation.

Ownership by WordPress administrators and platform teams.
Verify 'Delete local file' option is disabled.
Plan remediation based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Link Library plugin for WordPress?

Link Library is a WordPress plugin designed to help site owners manage and display collections of web links. It provides tools for users to submit their own links to the library and offers administrative features for managing these entries, such as linking them to local server files. By acting as a directory or bookmarking tool, it integrates directly with the site's content management structure to streamline link organization.

What is the vulnerability in CVE-2026-18855?

This vulnerability is classified as Improper Limitation of a Pathname to a Restricted Directory, or CWE-22. It occurs because the plugin fails to properly validate the file paths provided during the link deletion process. Because the software does not sufficiently check these paths, an attacker can manipulate the system into deleting files outside of the intended directory, potentially removing essential site files.

How does an attacker trigger this file deletion?

The attack path requires two steps. First, an unauthenticated user must submit a malicious link to the library. Second, an administrator must permanently delete that submitted link while the plugin's 'Delete local file on link deletion' feature is active. The vulnerability is not triggered if this specific setting remains disabled, nor does it occur if the administrator does not perform the moderation action on the attacker-provided input.

Why should I be concerned about this vulnerability?

Halo Surface Signal indicates that because this plugin is used in WordPress—a technology almost exclusively deployed as a public-facing web service—the risk of internet-based exploitation is higher. Since attackers can reach this functionality over the network without needing credentials, the potential for them to delete critical system files, such as configuration files that could facilitate a full system takeover, makes this a high-priority concern for any public site.

What are the first steps to handle CVE-2026-18855?

Begin by auditing your WordPress environment to identify if the Link Library plugin is installed. If found, immediately check the plugin settings to confirm whether the 'Delete local file on link deletion' option is enabled; if it is, disable it until you can update to a secure version. Determine which team owns the site to coordinate a formal update and verify the plugin version to ensure your instance is protected against this issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.