The Link Factory WordPress plugin contains a backdoor that exposes an operator‑controlled REST API at /wp-json/link-factory/v1/. The API is authenticated by a detached Ed25519 signature verified against a hard‑coded operator public key, except for a health‑check endpoint. If an attacker obtains or can forge the corresponding private key, they can invoke this API and run the code that the plugin’s backdoor author has implemented, effectively gaining remote control over the plugin’s functions and the ability to alter site content.

The vulnerability is present in every installation of the Link Factory plugin, regardless of version, as no specific version is listed. All WordPress sites that have the plugin active are affected, and the flaw is exposed through the plugin’s REST endpoint.

The vulnerability has a CVSS score of 10, indicating a critical severity, while the EPSS score is less than 1% and it is not listed in CISA’s KEV catalog. An attacker can reach the REST endpoint over HTTP/HTTPS, supply a valid or forged Ed25519 signature to authenticate, and trigger the operator’s code as defined by the plugin. The risk is high because the attacker needs only the signing key to fully exercise the API, and the flaw exists on any site running the plugin.