CVE-2026-15413: Link Factory WordPress Auth Bypass Flaw

CVE-2026-15413 Overview

CVE-2026-15413 identifies the Link Factory WordPress plugin as an intentional backdoor. The plugin markets itself as a "homepage sentence publisher" but exposes an operator-controlled REST API under /wp-json/link-factory/v1/. Requests to this API are authenticated by a detached Ed25519 signature verified against a hardcoded operator public key. Only the health check endpoint bypasses this signature check. Any operator holding the matching private key gains full remote control over affected WordPress installations. This yields complete site compromise without user interaction or valid credentials.

Critical Impact
The plugin ships a hardcoded operator public key that authorizes arbitrary REST API commands, granting the plugin author persistent remote control over every affected WordPress site.

Affected Products

Link Factory WordPress plugin (all distributed versions)
WordPress sites with the plugin installed and active
Any hosting environment exposing /wp-json/link-factory/v1/ endpoints

Discovery Timeline

2026-08-13 - CVE-2026-15413 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-15413

Vulnerability Analysis

The Link Factory plugin registers a custom REST namespace at /wp-json/link-factory/v1/. Every route, except a health check, requires a detached Ed25519 signature accompanying the request. The plugin verifies the signature against an operator public key embedded in the plugin source. Any actor who controls the corresponding private key can issue signed commands that the plugin executes on the WordPress host. Because verification succeeds independently of WordPress authentication, the backdoor operates outside the standard capability and nonce model. The plugin functions as a covert command-and-control channel rather than a legitimate publishing tool.

Root Cause

The root cause is hardcoded credential material combined with a covert authorization channel. The plugin trusts a static Ed25519 public key baked into its code and treats any signed request as authorized. This design pattern maps to hardcoded credentials and an intentional backdoor rather than an implementation defect.

Attack Vector

Exploitation requires only network access to the WordPress site and possession of the operator private key. The attacker crafts an HTTP request to a route under /wp-json/link-factory/v1/, attaches a valid detached Ed25519 signature, and receives command execution privileges scoped to the plugin's implemented operations. No user interaction, session, or WordPress credential is required. The scope change reflected in the CVSS vector indicates that compromise extends beyond the vulnerable component to the hosting WordPress installation and its data.

See the WPScan Vulnerability Report for the referenced technical breakdown.

Detection Methods for CVE-2026-15413

Indicators of Compromise

Presence of the Link Factory plugin directory or files in wp-content/plugins/
HTTP requests to any route under /wp-json/link-factory/v1/
Requests containing detached Ed25519 signature headers or parameters bound to Link Factory routes
Unexpected outbound connections initiated by the WordPress PHP process after plugin activation

Detection Strategies

Inventory installed WordPress plugins across the fleet and flag Link Factory installations for removal.
Inspect web server access logs for any hits to the /wp-json/link-factory/v1/ namespace and treat them as compromise indicators.
Review plugin source code for hardcoded public keys and REST route registrations that bypass WordPress capability checks.

Monitoring Recommendations

Alert on new file writes, plugin installations, or scheduled tasks created by the WordPress PHP user.
Monitor REST API traffic patterns for signed requests targeting non-standard namespaces.
Correlate WordPress plugin inventory changes with authentication and administrative activity in the site management console.

How to Mitigate CVE-2026-15413

Immediate Actions Required

Deactivate and delete the Link Factory plugin from every WordPress installation immediately.
Rotate all WordPress administrator credentials, API keys, and secrets stored on affected sites.
Audit wp-content/, active themes, mu-plugins, and scheduled cron entries for artifacts left by the backdoor operator.
Restore affected sites from a known-clean backup taken before the plugin was installed when tampering is confirmed.

Patch Information

No vendor patch is available because the plugin itself is the backdoor. Remediation requires complete removal of the plugin rather than an update. Refer to the WPScan Vulnerability Report for the current advisory status.

Workarounds

Block all external requests to /wp-json/link-factory/v1/ at the web application firewall or reverse proxy while removal is in progress.
Restrict WordPress REST API exposure to authenticated users where feasible.
Enforce plugin allowlisting so that only vetted, reputable plugins can be installed on production sites.

bash

# Example NGINX rule to block the backdoor REST namespace during remediation
location ~ ^/wp-json/link-factory/v1/ {
    deny all;
    return 403;
}