This vulnerability allows an unauthenticated user to submit a link to a library that requires login, effectively bypassing the authentication requirement. By reusing a form token from a different library that does not enforce login, the attacker can add content that should otherwise be protected, potentially compromising data integrity and user trust.

All installations of the Link Library WordPress plugin earlier than version 7.10.0 are affected. The flaw applies to sites that have at least two libraries configured, one requiring authentication and another not requiring authentication. No additional version details are available.

The CVSS score is not provided, but the nature of the bug—a direct login requirement bypass—implies moderate to high severity. Exploitation is straightforward: an attacker must obtain a form token from a non‑restricted library and then submit a link to a protected library. With no EPSS figure, the likelihood of exploitation is uncertain, and the vulnerability is not listed in CISA KEV, suggesting it may not yet be actively exploited but still represents a significant access control concern.