Path Traversal in Jackdewey Link Library

CVE-2026-18855

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action.

Vulnerability class: Path Traversal (Directory Traversal)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

EPSS exploit prediction

EPSS: 0.014 (70.5th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 70th percentile — 70.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-18855: held from 0.012 to 0.014.

EPSS over last 30 days · oldest: 0.012 · newest: 0.014 · change: +0.001

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-18855?
CVE-2026-18855 is a critical-severity vulnerability in Jackdewey Link Library, classified under Path Traversal. CVSS score: 9.1/10. Published 2026-08-15.
How severe is CVE-2026-18855?
Critical severity. CVSS v3 base score is 9.1 out of 10.