CVE-2026-15413

Name of the Vulnerable Software and Affected Versions Link Factory WordPress plugin (affected versions not specified)

Description The Link Factory WordPress plugin, distributed as a homepage sentence publisher, functions as a backdoor. It exposes an operator-controlled REST API endpoint at '/wp-json/link-factory/v1/'. Access to this endpoint is authenticated using a detached Ed25519 signature, which is verified against a hardcoded operator public key, with the exception of the health check function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.