THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-18855 (CRITICAL 9.1) — The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files

[NVD] CVE-2026-18855 (CRITICAL 9.1) — The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files

mednvdPublished 2026-08-15

CVE-2026-18855 CVSS: 9.1 CRITICAL Published: 2026-08-15T19:16:32.160

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote co

MITRE ATT&CK techniques

File DeletionT1070.004

Indicators of compromise

CVE-2026-18855cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-18855