CVE-2026-40779: WordPress Link Library plugin <= 7.8.8 - Arbitrary File Deletion vulnerability

Synopsis

An arbitrary file deletion vulnerability affects the WordPress Link Library plugin versions 7.8.8 and earlier. The flaw is reachable over the network by any authenticated user with at least contributor-level access, requiring no victim interaction. Successful exploitation lets an attacker delete arbitrary files on the server, which can disrupt service availability or destroy critical application data. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  The attacker must hold a valid WordPress account with at least contributor-level privileges; no admin account is needed.

• Victim interactionNot required

  No victim action is required; the attacker can trigger the file deletion directly without social engineering or user participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race wins, or environmental factors.

Blast Radius

• Attacker deletes arbitrary files on the server filesystem, including WordPress core files, theme files, or plugin files.
• Deletion of critical configuration files (such as wp-config.php) renders the WordPress site inoperable, causing a full service outage.
• Persistent data such as uploaded media or configuration backups stored on the same filesystem can be permanently destroyed with no recovery path if backups are absent.
• The availability impact is rated HIGH, meaning the attacker reliably takes the affected service offline or into a broken state.