The Link Library plugin for WordPress contains an insufficient file path validation bug that allows an attacker to delete any file on the server. By sending a crafted request to the ll_delete_link_fields function, the storage path of the file can be manipulated. If an attacker removes a critical configuration file, such as wp-config.php, arbitrary code can be executed on the site. Because the deletion is triggered during a normal link moderation step, the attack can be performed without any additional privileges.

The vulnerability affects the Jack Dewey Link Library WordPress plugin. Versions up through 7.9.4 are impacted; any site running 7.9.4 or earlier is susceptible. Upgrading to 7.9.5 or later eliminates the flaw.

The flaw has a CVSS score of 9.1, indicating a high impact. The EPSS score indicates a low probability of exploitation, at 1%, and the vulnerability is not listed in the CISA KEV catalog. The attack requires that the administrator has enabled the 'Delete local file on link deletion' option, a setting that defaults to disabled. After the option is active, an unauthenticated user can delete an arbitrary link, causing the editor to invoke the deletion routine and delete the targeted file. The attack vector is therefore unauthenticated but depends on a configuration that administrators may have left enabled.