CVE-2026-18855

Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.5

Description Insufficient file path validation in the ll delete link fields() function allows unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution if critical files, such as wp-config.php, are deleted. Exploitation occurs if the administrator has enabled the 'Delete local file on link deletion' option and subsequently performs a routine moderation action by permanently deleting a link submitted by the attacker.

Recommendations Update to a version newer than 7.9.4. Disable the 'Delete local file on link deletion' plugin option to prevent exploitation.