{"id":"CVE-2026-78396","kind":"vulnerability","aliases":["CVE-2026-78396"],"related":[],"title":"Link Library WordPress plugin leaks hidden contact details to visitors","description":"The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display.","summary":"The Link Library WordPress plugin before 7.10.0 fails to check that a requested link belongs to the display settings used to show it. An unauthenticated visitor can read the telephone number, email address and submitter name stored on links that are configured to stay hidden.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["link-library","package","self-hosted","wordpress"],"not_affected_if":["plugin-7.10.0-or-later","plugin-not-installed"],"how_to_check":"- Check the installed Link Library plugin version in the WordPress admin Plugins screen or with `wp plugin get link-library`\n- Confirm whether any settings set hides fields such as phone, email or submitter name","fix":"- Link Library plugin: move to `7.10.0` or later","status":"open","published_at":"2026-10-29T06:17:24+00:00","first_seen_at":"2026-10-29T06:53:14+00:00","triaged_at":"2026-10-29T06:54:38+00:00","updated_at":"2026-10-29T06:54:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T06:54:38Z","model":"claude-haiku-5-5","output":{"fix":"- Link Library plugin: move to `7.10.0` or later","reach":"internet","title":"Link Library WordPress plugin leaks hidden contact details to visitors","impact":"medium","summary":"The Link Library WordPress plugin before 7.10.0 fails to check that a requested link belongs to the display settings used to show it. An unauthenticated visitor can read the telephone number, email address and submitter name stored on links that are configured to stay hidden.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","link-library","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated visitors read hidden phone numbers and email addresses","analyst_note":"","how_to_check":"- Check the installed Link Library plugin version in the WordPress admin Plugins screen or with `wp plugin get link-library`\n- Confirm whether any settings set hides fields such as phone, email or submitter name\n- unknown for other checks","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-7.10.0-or-later","plugin-not-installed"],"who_is_affected":"Sites running the Link Library WordPress plugin older than 7.10.0 that list links with contact fields the settings set hides. The exposure comes from direct requests for individual link IDs, so sites where every stored link is shown publicly lose little. Sites on 7.10.0 or later, or without this plugin, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":4111,"output_tokens":550,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-78396':13A,16A '7.10.0':31B,76C 'address':57B,108C 'allow':97C 'belong':39B,84C 'check':34B 'configur':66B,120C 'contact':7A 'cve':11A,14A 'detail':8A 'disclos':101C 'display':42B,90C,123C 'e':106C 'e-mail':105C 'email':56B 'fail':32B 'hidden':6A,69B 'host':23B 'leak':5A 'librari':2A,19B,27B,72C 'link':1A,18B,26B,38B,63B,71C,83C,114C 'link-librari':17B 'mail':107C 'name':60B,111C 'number':55B,104C 'packag':20B 'plugin':4A,29B,74C 'read':52B 'render':95C 'request':37B,82C 'self':22B 'self-host':21B 'set':43B,87C,88C,117C,118C 'show':46B 'stay':68B 'store':61B,112C 'submitt':59B,110C 'telephon':54B,103C 'templat':91C 'unauthent':49B,98C 'use':44B,93C 'user':99C 'verifi':79C 'visitor':10A,50B 'whose':89C 'wordpress':3A,24B,28B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Link Library WordPress plugin older than 7.10.0 that list links with contact fields the settings set hides. The exposure comes from direct requests for individual link IDs, so sites where every stored link is shown publicly lose little. Sites on 7.10.0 or later, or without this plugin, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78396","severity":null,"published_at":"2026-10-29T06:17:24+00:00","modified_at":"2026-10-29T06:17:24+00:00","first_seen_at":"2026-10-29T06:53:14+00:00","fetched_at":"2026-10-29T06:53:14+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}