CVE-2026-40779: Link Library Path Traversal Vulnerability

CVE-2026-40779 Overview

CVE-2026-40779 is a path traversal vulnerability [CWE-22] affecting the Link Library plugin for WordPress in versions up to and including 7.8.8. The flaw allows authenticated users with Contributor-level privileges to delete arbitrary files on the underlying server. Successful exploitation can remove critical WordPress files such as wp-config.php, forcing the site into a setup state that an attacker can leverage for site takeover.

Critical Impact
An authenticated Contributor can delete arbitrary files on the host, enabling denial of service and potential WordPress site takeover by removing wp-config.php.

Affected Products

WordPress Link Library plugin versions <= 7.8.8
WordPress installations with the Link Library plugin enabled
Sites permitting Contributor or higher role registrations

Discovery Timeline

2026-06-15 - CVE-2026-40779 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-40779

Vulnerability Analysis

The vulnerability resides in a file-handling routine within the Link Library plugin that accepts a user-supplied file path and performs a deletion operation. The plugin fails to properly normalize and validate the supplied path against an allow-listed directory. An authenticated user holding the Contributor role can submit a crafted request that traverses outside the plugin's working directory and removes arbitrary files accessible to the web server process.

The scope-changed nature of the issue indicates the impact extends beyond the vulnerable component. Deleting WordPress core files such as wp-config.php triggers the WordPress installer on the next request. An attacker controlling that installer flow can reconfigure the site to use a database under their control, leading to full site compromise.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The affected handler treats user-controlled input as a trusted file reference and passes it to a deletion function without canonicalization or boundary checks. Sequences such as ../ are not stripped, and no validation confirms the resolved path resides within an intended directory.

Attack Vector

Exploitation requires network access to the WordPress admin endpoints and a valid Contributor account. The attacker submits an authenticated request to the vulnerable plugin action with a path parameter pointing outside the plugin directory. The server-side handler resolves the traversal sequence and unlinks the targeted file. No user interaction is required beyond the authenticated request. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-40779

Indicators of Compromise

Unexpected absence of wp-config.php or other WordPress core files on disk
WordPress installer prompt appearing on a previously configured site
Authenticated POST requests to Link Library plugin endpoints containing ../ sequences in parameters
New Contributor-role accounts created shortly before file deletion events

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php or admin-post.php referencing Link Library actions with suspicious path parameters
Enable file integrity monitoring on the WordPress root and wp-content/plugins/link-library/ directories
Correlate Contributor account activity with file deletion events on the web host

Monitoring Recommendations

Alert on any deletion of files under the WordPress root by the web server user
Monitor creation of low-privilege accounts followed by plugin-specific admin requests
Forward WordPress and web server logs to a centralized log platform for retention and query

How to Mitigate CVE-2026-40779

Immediate Actions Required

Update the Link Library plugin to a version above 7.8.8 once released by the maintainer
Audit existing Contributor and higher-role accounts and remove unknown or stale users
Restrict open user registration if not required for site operations
Back up wp-config.php and the WordPress database before applying changes

Patch Information

A fixed version above 7.8.8 should be installed when published by the Link Library maintainer. Refer to the Patchstack Vulnerability Report for the current patch status.

Workarounds

Deactivate and remove the Link Library plugin until a patched version is available
Apply a web application firewall rule blocking path traversal sequences in plugin request parameters
Restrict filesystem permissions so the web server user cannot delete files outside wp-content/uploads/
Disable the Contributor role or restrict its capabilities via a role management plugin

bash

# Configuration example: tighten filesystem permissions on WordPress root
chown -R root:www-data /var/www/html
find /var/www/html -type d -exec chmod 755 {} \;
find /var/www/html -type f -exec chmod 644 {} \;
chmod 640 /var/www/html/wp-config.php