The Link Factory WordPress plugin contains a hard‑coded operator backdoor that exposes a REST endpoint at /wp-json/link-factory/v1/. The endpoint is authenticated with a detached Ed25519 signature that is verified against a hard‑coded public key. When the correct signature is presented, the API allows the operator to perform arbitrary actions such as publishing sentences, modifying content, or executing server‑side code. This backdoor effectively grants an attacker who obtains or can forge the private key remote control over the WordPress site, enabling data tampering, information disclosure, and the possibility of full remote code execution.

The vulnerability resides in the Link Factory WordPress plugin, distributed through the WordPress plugin repository. No specific product versions are listed; the flaw exists wherever the plugin is installed. The attack surface is limited to sites running the plugin and hosting the plugin’s REST API.

The CVSS score of 10 indicates a critical severity. The EPSS is unavailable and the vulnerability is not currently listed in the CISA KEV catalog, but the presence of a server‑controlled API coupled with hard‑coded cryptographic material means the risk is high. An attacker can reach the endpoint over HTTP/S, supply a valid or forged signature, and trigger any exposed behavior. Because the API bypasses authentication only for a health‑check, a compromised signing key would permit full remote exploitation. The high severity of the defect suggests the risk is significant and remediation should occur as soon as possible.