{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3alink_library_projectlink_librarywordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:link_library_project:link_library:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-15090"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Link Library (\u003c= 7.9.2)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","sql-injection","wordpress"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Link Library plugin for WordPress (versions 7.9.2 and earlier) contains a critical security flaw identified as CVE-2026-15090. This vulnerability is a time-based SQL injection resulting from insufficient sanitization of the 'link_url' parameter and the failure to use prepared statements in the underlying SQL queries. An unauthenticated attacker can exploit this flaw by sending crafted HTTP requests containing malicious SQL payloads. By observing time delays in the server response, attackers can iteratively infer data from the database. This vulnerability poses a significant risk to the confidentiality of site data, as successful exploitation allows for unauthorized extraction of sensitive information from the WordPress database. Defenders should note that this vulnerability is exploitable via standard web traffic targeting the plugin's interface.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthenticated attackers to perform blind SQL injection against the WordPress database. This can lead to the full compromise of sensitive data, including user credentials, configuration details, and site content. Given the widespread use of WordPress plugins, organizations running versions 7.9.2 or earlier of Link Library are at high risk of data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Link Library plugin to the latest available version beyond 7.9.2 immediately to patch the vulnerable parameter handling.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST or GET requests to the Link Library plugin endpoints containing common SQL injection characters (e.g., SLEEP, BENCHMARK, WAITFOR, or stacked query delimiters like ';').\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) to block requests containing suspected SQL injection patterns targeting the 'link_url' parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T06:35:33Z","date_published":"2026-10-15T06:35:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-link-library-sqli/","summary":"The Link Library plugin for WordPress is vulnerable to unauthenticated time-based SQL injection via the 'link_url' parameter, enabling potential database information exfiltration.","title":"CVE-2026-15090: SQL Injection in Link Library WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-link-library-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:link_library_project:link_library:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}