Exploitation Research Plan: CVE-2026-40779 (Link Library Arbitrary File Deletion)

1. Vulnerability Summary

The Link Library plugin (versions <= 7.8.8) contains an arbitrary file deletion vulnerability in its administrative logic. The vulnerability resides in link-library-admin.php within the action_admin_init method, which is hooked to admin_init. The code fails to validate the file path provided via a GET parameter and lacks both capability checks and nonce verification. This allows any authenticated user with access to the WordPress admin area (Contributor level and above) to delete arbitrary files on the server, including wp-config.php, which can lead to a full site takeover or Remote Code Execution (RCE).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin.php (or any admin page that triggers admin_init).
• HTTP Method: GET
• Vulnerable Parameter: link_library_delete_file
• Authentication: Required (Contributor role or higher).
• Preconditions:
  • The plugin must be active.
  • The attacker must have a valid session for a user with at least Contributor level access (which allows them to access wp-admin/).

3. Code Flow

1. Hook Registration: In link-library-admin.php, the link_library_plugin_admin class constructor registers the action_admin_init function:

   add_action( 'admin_init', array( $this, 'action_admin_init' ) );
   

2. Entry Point: When any user (including a Contributor) accesses /wp-admin/, the admin_init hook fires.
3. Vulnerable Logic: Inside action_admin_init (located in link-library-admin.php), the code checks for the existence of the link_library_delete_file parameter:

   // Inferred logic based on vulnerable version 7.8.8
   function action_admin_init() {
       if ( isset( $_GET['link_library_delete_file'] ) ) {
           $file = $_GET['link_library_delete_file'];
           if ( file_exists( $file ) ) {
               unlink( $file ); // Sink: Arbitrary File Deletion
           }
           // ... redirection logic ...
       }
   }
   

4. The Sink: The unlink() function is called directly on the user-supplied string without sanitization (e.g., realpath() checks) or access control checks.

4. Nonce Acquisition Strategy

This vulnerability does not require a nonce. The vulnerable code block in action_admin_init processes the $_GET parameter before any check_admin_referer or wp_verify_nonce calls are made. This is a common pattern in older WordPress plugins where "cleanup" actions are added to admin_init without CSRF protection.

5. Exploitation Strategy

The exploit will involve authenticated requests to the admin panel using the http_request tool.

Step-by-Step Plan:

1. Prepare Test Data: Create a file in the WordPress root to simulate a sensitive file (like wp-config.php).
2. Authentication: Log in as a Contributor user to obtain valid session cookies.
3. Deletion Attempt (Relative Path):
   • Construct a GET request to /wp-admin/index.php.
   • Append the parameter link_library_delete_file=../test-file.txt.
   • Since the PHP working directory for admin_init is usually /wp-admin/, ../ points to the WordPress root.
4. Deletion Attempt (Absolute Path):
   • If relative paths fail, attempt deletion using the standard WordPress absolute path: /var/www/html/test-file.txt.
5. Verification: Check if the file still exists using wp-cli.

Expected Payloads:

• Relative Payload: ?link_library_delete_file=../test-file.txt
• Absolute Payload: ?link_library_delete_file=/var/www/html/test-file.txt

6. Test Data Setup

1. Create Target File:

   echo "test data" > /var/www/html/delete-test.txt
   

2. Create Contributor User:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

7. Expected Results

• The server will process the request.
• The action_admin_init function will execute and call unlink() on the provided path.
• The HTTP response might be a 302 Redirect back to a Link Library settings page (even if the user can't access it, the file deletion happens first).
• The file /var/www/html/delete-test.txt will be removed from the filesystem.

8. Verification Steps

1. Check File Existence:

   ls /var/www/html/delete-test.txt
   

   Expected outcome: "ls: cannot access '/var/www/html/delete-test.txt': No such file or directory"
2. Confirm Absence of Permissions Error: If the user lacks the manage_options capability, they might see a "You do not have sufficient permissions" message after the file has already been deleted, because the unlink() call occurs early in the admin_init lifecycle.

9. Alternative Approaches

If link_library_delete_file is not the correct parameter name (though highly likely), investigate other common parameters used by this plugin for file handling:

• ll_delete_file
• delete_export_file
• link_library_delete_log

Additionally, check if the deletion is triggered by a specific ll_action parameter:

• ?ll_action=delete_export&file=../../wp-config.php
• ?ll_action=delete_log&file=../../wp-config.php

If the admin_init hook is restricted, check the before_delete_post hook (ll_delete_link_fields). A Contributor can create a link, set the link_image meta field to a target file path, and then delete that link, potentially triggering an unlink() in the cleanup function.