Link Factory - Backdoor

Description

The plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under `/wp-json/link-factory/v1/` — authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).

It makes it possible for the plugin's operator, without any WordPress account, to:

- create a hidden administrator account with a randomly generated `lf_`-prefixed login and retrieve its credentials (`POST /users`), and check or delete it (`POST /users/check`, `DELETE /users/{login}`);
- publish arbitrary posts authored by a site administrator (`POST /articles`, `DELETE /articles/{id}`);
- inject operator-controlled HTML into a hidden, off-screen container rendered in the site footer, for black-hat SEO / backlink injection (`POST /sentences`, `DELETE /sentences/{id}`);
- fingerprint the plugin's presence and version via an unauthenticated beacon (`GET /health`).

This results in full, persistent site compromise. The plugin's own source describes the administrator channel as a "plugin-owned access path that does not depend on seller credentials" — i.e. the operator retains administrator access to "donor" sites independently of the site owner.