CVE-2026-78394
Received Received - Intake

Path Traversal in Link Library WordPress Plugin

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: WPScan

Description
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-78394
EUVD
EUVD-2026-86528

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
link_library link_library to 7.9.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in the Link Library WordPress plugin versions 7.9.6 and below. It allows users with Contributor role or higher to specify arbitrary directories outside the site's document root for saving image files. The plugin fails to sanitize user-supplied folder paths before writing files, enabling unauthorized directory creation and file manipulation.

Detection Guidance

Check for unauthorized numeric image files outside the expected directories. Inspect web server logs for requests containing the 'filepath' parameter with path traversal sequences like '../'. Verify plugin version is below 7.9.6.

Impact Analysis

An attacker could overwrite existing files, create directories in unauthorized locations, or manipulate files to cause denial of service. While executable code cannot be planted directly due to fixed numeric filenames with image extensions, the vulnerability still allows unauthorized file system changes that could disrupt operations or lead to further attacks.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by allowing unauthorized file access or modification. It may result in data breaches, unauthorized data exposure, or integrity violations, potentially violating confidentiality and integrity requirements of these standards.

Mitigation Strategies

Update the Link Library plugin to version 7.9.6 or higher immediately. Remove write permissions for web server users outside the document root. Monitor for suspicious file creation and unauthorized directory creation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart