CVE-2026-15090 Overview
The Link Library plugin for WordPress contains a time-based SQL injection vulnerability in the link_url parameter. The flaw affects all versions up to and including 7.9.2. Insufficient escaping of user-supplied input combined with inadequate SQL query preparation allows unauthenticated attackers to append arbitrary SQL to existing queries. Successful exploitation enables extraction of sensitive data from the WordPress database, including user credentials, session tokens, and site configuration. The issue is tracked under CWE-89 and was reported through Wordfence. The vendor addressed the issue in version 7.9.3.
Critical Impact
Unauthenticated attackers can extract sensitive database content, including administrator credentials and session data, through time-based blind SQL injection.
Affected Products
- Link Library plugin for WordPress, all versions up to and including 7.9.2
- WordPress sites that expose the user submission functionality in usersubmission.php
- Patched release: Link Library 7.9.3
Discovery Timeline
- 2026-10-15 - CVE-2026-15090 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-15090
Vulnerability Analysis
The vulnerability is a time-based blind SQL injection in the Link Library plugin's user submission handler. The link_url parameter flows into a SQL query without proper escaping or parameterized preparation. Attackers inject SQL fragments such as time-delay functions to infer data one bit at a time by observing response latency. Because the attack vector is network-based and requires no authentication or user interaction, any publicly reachable WordPress site running the plugin is exposed. The upstream fix is visible in the plugin changeset and the tag diff between 7.9.2 and 7.9.3.
Root Cause
The root cause is a failure to properly sanitize and prepare the link_url input before concatenating it into a SQL statement. WordPress provides $wpdb->prepare() with placeholders for safe parameter binding, but the vulnerable code path in usersubmission.php did not use it correctly. This classic CWE-89 pattern lets attacker-controlled strings alter query structure rather than data.
Attack Vector
An unauthenticated remote attacker sends a crafted HTTP request to the user submission endpoint with a malicious link_url value. The payload typically includes conditional SQL combined with SLEEP() or BENCHMARK() to produce measurable response delays. By iterating queries that encode one bit of a target value per request, the attacker reconstructs tables such as wp_users, extracting usernames, password hashes, and secret keys stored in site options.
No verified public exploit code is available at this time. Refer to the Wordfence advisory for additional technical context.
Detection Methods for CVE-2026-15090
Indicators of Compromise
- POST or GET requests to Link Library submission endpoints containing SQL keywords such as SLEEP(, BENCHMARK(, UNION SELECT, or SELECT CASE WHEN in the link_url parameter.
- Repeated requests from the same source with incrementally changing payloads and server response times that cluster near fixed delay values.
- Unexpected read activity against sensitive tables like wp_users or wp_options in database query logs.
Detection Strategies
- Deploy a web application firewall ruleset that inspects the link_url parameter for SQL metacharacters and known time-delay functions.
- Enable MySQL slow query logging and alert on queries originating from the plugin that reference user or option tables with suspicious predicates.
- Correlate web server access logs with database query timing to flag request bursts that match time-based inference patterns.
Monitoring Recommendations
- Track all HTTP requests targeting usersubmission.php under the Link Library plugin path and alert on anomalous parameter length or encoding.
- Monitor outbound traffic from the WordPress host for data exfiltration following suspicious inbound SQL injection attempts.
- Baseline normal response latency for plugin endpoints and alert on sustained response times above the baseline, which indicate time-based probing.
How to Mitigate CVE-2026-15090
Immediate Actions Required
- Update the Link Library plugin to version 7.9.3 or later on all WordPress sites.
- Audit wp_users and administrator accounts for unauthorized changes and rotate all administrator passwords and application secrets.
- Rotate WordPress secret keys and salts in wp-config.php to invalidate any stolen session cookies.
Patch Information
The maintainer released Link Library 7.9.3, which corrects the input handling in usersubmission.php. The fix is published in the WordPress plugin repository changeset 3616353. Site operators should apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Disable or deactivate the Link Library plugin until the patched version is installed.
- Block requests to the plugin's user submission endpoints at the WAF or reverse proxy layer.
- Restrict access to the WordPress site to known IP ranges while remediation is in progress.
# Update Link Library to the patched version using WP-CLI
wp plugin update link-library --version=7.9.3
wp plugin list --name=link-library --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
