Live › vulnerability › CVE-2026-78395
The Link Library WordPress plugin does not re-check whether the chosen library requires login when processing a front-end link submission. An unauthenticated visitor can reuse a form token from a library that allows anonymous submissions to post links into a library that requires login.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the Link Library WordPress plugin older than 7.10.0 that have at least one library configured to require login for front-end link submissions. Sites that do not use the plugin, run 7.10.0 or later, or accept no front-end submissions are not exposed. Exploitation requires a form token from a library that does not require login, which is public on the front end.
No product ranges from the sources yet.
wp-content/plugins/.7.10.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.
This page as .md · .json · in your agent: get_signal("CVE-2026-78395")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.