Description
The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Published: 2026-08-03
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerable Link Library WordPress plugin (pre‑7.9.3) fails to sanitise user input submitted through its front‑end link submission form. This flaw allows unauthenticated attackers to inject malicious SQL statements that execute with the database user’s privileges, potentially permitting arbitrary data extraction, modification, or loss of integrity.

Affected Systems

WordPress sites using the Link Library plugin before version 7.9.3 are affected. The vulnerability exists in the front‑end submission form; any site hosting the plugin without an updated version is at risk.

Risk and Exploitability

The CVSS score is 9.1, but the flaw permits unauthenticated exploitation via the public web interface, enabling attackers to compromise the database. EPSS score < 1% and the vulnerability is not listed in CISA KEV, however the lack of authentication and the ability to alter data represent a high risk for confidentiality and integrity.

Generated by OpenCVE AI on August 4, 2026 at 21:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Link Library plugin to version 7.9.3 or later.
  • Disable or restrict the front‑end link submission form for unauthenticated users if an upgrade is not immediately possible.
  • Perform an audit of the database for unauthorized changes and consider tightening database user permissions to enforce the principle of least privilege.

Generated by OpenCVE AI on August 4, 2026 at 21:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Link Library Project
Link Library Project link Library
Wordpress
Wordpress wordpress
Vendors & Products Link Library Project
Link Library Project link Library
Wordpress
Wordpress wordpress

Mon, 03 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 09:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-89

Mon, 03 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Description The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Title Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form
References

Subscriptions

Link Library Project Link Library
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-08-03T17:01:28.911Z

Reserved: 2026-07-22T08:42:53.140Z

Link: CVE-2026-16532

cve-icon Vulnrichment

Updated: 2026-08-03T17:01:23.648Z

cve-icon NVD

Status : Deferred

Published: 2026-08-03T07:16:41.557

Modified: 2026-08-26T16:31:16.753

Link: CVE-2026-16532

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T09:45:07Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')