CVE-2026-15090: SQL Injection in Link Library WordPress Plugin

The Link Library plugin for WordPress (versions 7.9.2 and earlier) contains a critical security flaw identified as CVE-2026-15090. This vulnerability is a time-based SQL injection resulting from insufficient sanitization of the 'link_url' parameter and the failure to use prepared statements in the underlying SQL queries. An unauthenticated attacker can exploit this flaw by sending crafted HTTP requests containing malicious SQL payloads. By observing time delays in the server response, attackers can iteratively infer data from the database. This vulnerability poses a significant risk to the confidentiality of site data, as successful exploitation allows for unauthorized extraction of sensitive information from the WordPress database. Defenders should note that this vulnerability is exploitable via standard web traffic targeting the plugin's interface.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to perform blind SQL injection against the WordPress database. This can lead to the full compromise of sensitive data, including user credentials, configuration details, and site content. Given the widespread use of WordPress plugins, organizations running versions 7.9.2 or earlier of Link Library are at high risk of data exfiltration.

Recommendation

• Update the Link Library plugin to the latest available version beyond 7.9.2 immediately to patch the vulnerable parameter handling.
• Monitor web server access logs for anomalous POST or GET requests to the Link Library plugin endpoints containing common SQL injection characters (e.g., SLEEP, BENCHMARK, WAITFOR, or stacked query delimiters like ';').
• Implement a Web Application Firewall (WAF) to block requests containing suspected SQL injection patterns targeting the 'link_url' parameter.