WordPress Plugin Vulnerabilities
Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass
Description
The plugin does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.
Proof of Concept
Affects Plugins
Fixed in 7.10.0 References
CVE
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Daria Golikova
Submitter
Daria Golikova
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-26 (about 3 days ago)
Added
2026-10-26 (about 2 days ago)
Last Updated
2026-10-26 (about 2 days ago)
