The vulnerability occurs in the Link Library WordPress plugin prior to version 7.9.6, where a contributor or higher privileged user can supply a destination folder name without sanitization. This allows the creation of directories and the writing of image files—always numeric names with static image extensions—anywhere the web server writeable file system permits. While the file names preclude placement of executable code directly, attackers can overwrite existing files outside the document root, potentially causing denial of service, information disclosure, or modification of critical files such as configuration files.

Any WordPress installation that is running the Link Library plugin earlier than version 7.9.6 and has Contributor role users or higher is affected. The vulnerable product is the Link Library plugin by Unknown:Link Library. Precise version ranges are limited to those before 7.9.6, and the patch is applied by updating the plugin to 7.9.6 or a later release.

The CVSS score is not disclosed, but the lack of input validation results in a path traversal that grants write access wherever the web server can write. Because authentication is required (Contributor role or higher), an attacker must first compromise or be granted such a role, which is a non‑zero but limited attack surface. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Nonetheless, once obtained, the ability to overwrite arbitrary files poses a significant risk. There is no known exploitation to drop malicious code due to the fixed numeric image file names, but the impact remains serious when critical files can be corrupted.