Directory Write Vulnerability in Link Library Plugin for WordPress
CVE-2026-78394
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 25 September 2026
Badges
What is CVE-2026-78394?
The Link Library WordPress plugin prior to version 7.9.6 contains a flaw that permits unauthorized users with the Contributor role and higher to create directories and manipulate image files on the server. This vulnerability arises due to a lack of proper sanitation of user-supplied input, allowing for file operations beyond the intended directory, which poses risks to the application's integrity and security. Despite the limitation that file names are numeric with fixed extensions, the ability to write files outside the designated folders can still lead to potential exploits.
Affected Version(s)
Link Library 0 < 7.9.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.