CVE-2026-15090

Executive Summary

CVE-2026-15090 is a time-based SQL injection vulnerability in the Link Library plugin for WordPress, affecting all versions up to and including 7.9.2. The flaw resides in insufficient escaping of the user-supplied link_url parameter combined with inadequate preparation of the underlying SQL query, allowing unauthenticated attackers to append arbitrary SQL into existing queries. Successful exploitation permits extraction of sensitive information from the WordPress database, with a CVSS base score of 7.5 reflecting high confidentiality impact over the network with no authentication or user interaction required.

Technical Analysis

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. According to the NVD description, the injection point is the link_url parameter, and the injection technique is specifically time-based. The root cause is two-fold: (1) insufficient escaping applied to the user-supplied parameter value, and (2) a lack of sufficient preparation on the existing SQL query. When a parameter is neither escaped nor bound through a prepared statement, attacker-supplied input is interpreted by the database engine as part of the SQL statement itself rather than as inert data.

Because the injection is time-based, the attacker's ability to infer information does not depend on the application returning query results or error messages to the response. Instead, the attacker measures server response latency to distinguish true from false conditions. The database is instructed to delay its response conditionally — for example, incurring a sleep when a tested condition evaluates true — and the attacker reconstructs data one predicate at a time by observing which requests are slow. This makes time-based SQL injection particularly resilient against environments where output is suppressed or errors are masked.

The attack surface is the public-facing WordPress site hosting the vulnerable Link Library plugin. Critically, the vulnerability is unauthenticated: no valid session, account, or role is required, meaning the link_url parameter is reachable and processable by anonymous visitors. The link_url parameter, based on its name, relates to a URL value presented in the plugin's link-listing functionality. The NVD description does not specify the exact HTTP method, route, or whether the parameter is submitted via query string or request body; accordingly, the precise request form is not enumerated here.

No public proof-of-concept, exploit code, or Nuclei template was identified at the time of this report. Technical specifics beyond the link_url parameter and the time-based technique are not available from the source advisory, and no code-level details (such as function or class names) are provided in the NVD description or CNA title.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the details disclosed in the NVD description.

1. Reconnaissance / target identification. An attacker enumerates WordPress installations and fingerprints the presence of the Link Library plugin. Public web indexing and Shodan-style scans matching plugin assets (link-library in the page source) help identify candidate targets. Because the flaw is unauthenticated, no valid credentials or accounts are needed — any internet-reachable site running the plugin version at or below 7.9.2 is potentially in scope.

2. Triggering the flaw class. The attacker sends a request containing a crafted link_url value. Because the parameter is insufficiently escaped and the SQL query is not properly prepared, the attacker's input is concatenated into the query in a way that allows additional SQL logic to be appended to the original statement. The attacker first appends a benign time-delay condition to confirm that the parameter is injectable (a measurable response delay indicates success).

3. Payload/execution method at the vulnerability-class level. Using time-based blind SQL injection, the attacker issues a series of requests in which the link_url payload embeds conditional logic combined with a database sleep/delay function. True conditions produce an observable delay; false conditions return promptly. By iterating over characters and byte values — comparing substrings of database metadata against candidate values — the attacker systematically reconstructs query results without any direct output being reflected.

4. Post-exploitation impact. Because the injection permits appending arbitrary SQL to the existing query, the attacker can extract sensitive information from the database. For a WordPress deployment this commonly includes user records (usernames and password hashes), configuration values, and other application data stored in MySQL tables. The confidentiality impact is rated High; integrity and availability impacts are rated None per the CVSS vector.

Impact Assessment

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N produces a base score of 7.5 (High). The subscores indicate: Network attack vector (remotely reachable), Low attack complexity (no special conditions required), No privileges required (unauthenticated), No user interaction (no victim action needed), Unchanged scope (impact confined to the vulnerable component's security authority), High confidentiality impact, and no integrity or availability impact.

Business impact centers on data exposure. Extracted data can include sensitive records from the WordPress database — potentially credential material, personally identifiable information, and other application secrets — which can be leveraged for lateral movement, account takeover (if password hashes are cracked or reused), or further targeted attacks. The blast radius extends to every site running the affected plugin version that is reachable from untrusted networks. Because the exploitation is time-based and blind, it may evade detection by tools that rely on reflected error output, and query volume cannot be reliably used as sole evidence.

Detection Guidance

Sigma Rule

title: Link Library WordPress Plugin Time-Based SQL Injection Attempt (link_url)
id: 4c9f2b7e-8a1d-4f6c-9e33-1d7a5c0b9f21
status: experimental
description: Detects time-based SQL injection attempts against the WordPress Link Library plugin via the link_url parameter.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-15090
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_param:
    cs-uri-query|contains:
      - 'link_url='
  selection_sqli:
    cs-uri-query|re:
      - '(?i)(sleep\s*\(|benchmark\s*\(|pg_sleep\s*\(|waitfor\s+delay|from\s+pg_sleep)'
      - '(?i)link_url=.*(\band\b|\bor\b|\bunion\b|\bselect\b)'
      - '(?i)link_url=.*(%27|'').*(sleep|benchmark|waitfor)'
  condition: selection_param and selection_sqli
falsepositives:
  - Legitimate URL values containing SQL keywords in the link_url parameter
  - Security scanners and penetration testing activity
level: high

YARA Rule

rule CVE_2026_15090_LinkLibrary_SQLi
{
    meta:
        description = "Detects time-based SQL injection payloads targeting the WordPress Link Library plugin link_url parameter"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-15090"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $p1 = "link_url=" ascii nocase
        $sqli1 = "SLEEP(" ascii nocase
        $sqli2 = "BENCHMARK(" ascii nocase
        $sqli3 = "pg_sleep(" ascii nocase
        $sqli4 = "WAITFOR DELAY" ascii nocase
        $sqli5 = "AND 1=1" ascii nocase
        $sqli6 = "AND 1=2" ascii nocase
        $sqli7 = "' AND " ascii nocase
        $sqli8 = "UNION SELECT" ascii nocase

    condition:
        $p1 and any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-15090 Link Library WordPress Plugin Time-Based SQL Injection Attempt (link_url)"; flow:established,to_server; http.uri; content:"link_url="; nocase; http.uri; pcre:"/(?i)(sleep\s*\(|benchmark\s*\(|pg_sleep\s*\(|waitfor\s+delay)/"; reference:cve,2026-15090; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-15090; classtype:web-application-attack; sid:2026150901; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where network.protocol == "http" and http.request.method == "GET" and
     url.query contains "link_url=" and
     url.query regex~ "(?i)(sleep\\s*\\(|benchmark\\s*\\(|pg_sleep\\s*\\(|waitfor\\s+delay)"]
  [network where network.protocol == "http" and
     url.query contains "link_url=" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower = lower(uri_query)
| where like(uri_lower, "%link_url=%")
| where match(uri_lower, "(sleep\s*\(|benchmark\s*\(|pg_sleep\s*\(|waitfor\s+delay|%27.*and|union.*select)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, dest_host
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,sqli,">
  <rule id="20261509" level="12">
    <if_sid>31100</if_sid>
    <url>link_url=</url>
    <regex type="pcre2">(?i)(sleep\s*\(|benchmark\s*\(|pg_sleep\s*\(|waitfor\s+delay)</regex>
    <description>CVE-2026-15090: Possible time-based SQL injection against WordPress Link Library plugin via link_url parameter.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sqli,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The NVD entry lists a patch reference, but no vendor-confirmed fixed version could be independently verified. Treat the patch status as unconfirmed until validated against the vendor's release notes.

1. Immediate mitigations.

   • If the Link Library plugin is not required, deactivate and remove it from all internet-facing WordPress installations.
   • If it must remain, restrict access to affected functionality using a Web Application Firewall (WAF) with virtual patching rules that block SQL metacharacters and time-delay functions (SLEEP, BENCHMARK, pg_sleep, WAITFOR DELAY) in the link_url parameter.
   • Enforce the principle of least privilege on the database account used by WordPress to reduce the scope of extractable data.
   • Monitor web server and database logs for anomalous latency and repeated requests containing SQL syntax in the link_url parameter.

2. Patch/upgrade steps.

   • Check the vendor's WordPress plugin repository for a version newer than 7.9.2 that addresses CVE-2026-15090.
   • Because the patch claim is single-sourced and unconfirmed, verify the fixed version against the plugin's official changelog before relying on it.
   • Stage the upgrade in a non-production environment, validate plugin functionality, then deploy to production.

3. Long-term hardening.

   • Enforce a plugin lifecycle policy: track versions, subscribe to vulnerability feeds, and remove abandoned or unused plugins.
   • Ensure all custom and third-party code uses parameterized queries / prepared statements rather than string-concatenated SQL, and apply proper input validation and output escaping.
   • Deploy and maintain a WAF in front of all WordPress sites and keep detection content current.
   • Enable verbose but securely-stored database and web logs, and centralize them in a SIEM for correlation and alerting.

References

• NVD — CVE-2026-15090: https://nvd.nist.gov/vuln/detail/CVE-2026-15090
• MITRE CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WordPress Plugin Security documentation: https://developer.wordpress.org/plugins/security/
• OWASP SQL Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data. CISA KEV status: NOT listed. No public PoC, exploit code, or Nuclei template was found at the time of this report.