---
id: "CVE-2026-78396"
kind: "vulnerability"
aliases: ["CVE-2026-78396"]
title: "Link Library WordPress plugin leaks hidden contact details to visitors"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["link-library", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-7.10.0-or-later", "plugin-not-installed"]
published_at: "2026-10-29T06:17:24+00:00"
first_seen_at: "2026-10-29T06:53:14+00:00"
updated_at: "2026-10-29T06:54:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78396", "first_seen_at": "2026-10-29T06:53:14+00:00"}]
---

# Link Library WordPress plugin leaks hidden contact details to visitors

The Link Library WordPress plugin before 7.10.0 fails to check that a requested link belongs to the display settings used to show it. An unauthenticated visitor can read the telephone number, email address and submitter name stored on links that are configured to stay hidden.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Link Library plugin version in the WordPress admin Plugins screen or with `wp plugin get link-library`
- Confirm whether any settings set hides fields such as phone, email or submitter name

## Fix

- Link Library plugin: move to `7.10.0` or later

## Timeline

- 2026-10-29T06:53:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-78396

## From the sources

The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_