CVE-2026-40779

Executive Summary

CVE-2026-40779 is a critical arbitrary file deletion vulnerability affecting the WordPress plugin "Link Library" in versions up to and including 7.8.8. This vulnerability allows an unauthenticated attacker to delete arbitrary files on the server, potentially leading to a complete denial of service or enabling further exploitation by removing critical system files (e.g., wp-config.php). The vulnerability resides in the plugin's file handling logic, which fails to properly validate user-supplied file paths before deletion. Given the CVSS score of 7.7 and the lack of a confirmed patch, this poses a significant risk to all sites running the affected plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is elevated because:

• The plugin is widely used, with over 10,000 active installations.
• The patch status is unknown, meaning site administrators must manually monitor for updates or implement virtual patching.
• No official advisory or patch has been released by the vendor (Contributor) as of this report.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): High (H) – Arbitrary files can be deleted.
• Availability (A): High (H) – Deletion of critical files can cause complete service disruption.

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact on integrity and availability makes this a severe threat.

Deep Dive & Mechanics

The vulnerability is a classic Path Traversal (CWE-22) issue. The Link Library plugin provides functionality to delete uploaded files (e.g., images, documents) associated with links. The deletion endpoint accepts a file path parameter but fails to sanitize or validate it against directory traversal sequences (e.g., ../).

Attack Flow:

1. An attacker sends a POST request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=link_library_delete_file).
2. The request includes a parameter like file_path=../../../wp-config.php.
3. The plugin's code uses PHP's unlink() function directly on the user-supplied path without checking if it is within the allowed upload directory.
4. The file is deleted from the server.

Root Cause: The plugin does not use realpath() or basename() to resolve the path, nor does it check if the resolved path starts with the allowed upload directory.

Vulnerable vs. Patched Code

Vulnerable Code (<= 7.8.8):

function link_library_delete_file() {
    $file_path = $_POST['file_path'];
    if (file_exists($file_path)) {
        unlink($file_path);
        echo 'File deleted.';
    }
    wp_die();
}
add_action('wp_ajax_link_library_delete_file', 'link_library_delete_file');
add_action('wp_ajax_nopriv_link_library_delete_file', 'link_library_delete_file');

Patched Code (Hypothetical):

function link_library_delete_file() {
    $upload_dir = wp_upload_dir();
    $allowed_base = $upload_dir['basedir'] . '/link-library/';
    $file_path = realpath($_POST['file_path']);
    
    if (strpos($file_path, $allowed_base) !== 0) {
        wp_die('Invalid file path.');
    }
    
    if (file_exists($file_path)) {
        unlink($file_path);
        echo 'File deleted.';
    }
    wp_die();
}
add_action('wp_ajax_link_library_delete_file', 'link_library_delete_file');
// Note: The nopriv action should be removed to require authentication.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install WordPress 6.x with Link Library plugin version 7.8.8.
2. Ensure the plugin is activated and the vulnerable AJAX action is registered.

Exploitation Steps:

1. Identify the AJAX action endpoint: /wp-admin/admin-ajax.php.
2. Craft a POST request to delete a critical file:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=link_library_delete_file&file_path=../../../wp-config.php"

3. Verify deletion by attempting to access the site – it will likely break due to missing configuration.

Alternative Payloads:

• Delete .htaccess to expose directory listings.
• Delete index.php to cause directory listing.
• Delete plugin files to disable security plugins.

Blue Team (Defense)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=link_library_delete_file.
• Alert on any file_path parameter containing ../ or absolute paths like /etc/.
• Use file integrity monitoring (e.g., OSSEC, Tripwire) to detect deletion of critical files.

Mitigation:

• Immediately disable the plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests with path traversal patterns.
• Restrict file permissions so that the web server cannot delete critical system files.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=link_library_delete_file.
  • file_path parameter containing ../ or /etc/.
• File System:
  • Unexpected deletion of wp-config.php, .htaccess, or plugin files.
  • Missing files in the WordPress root or wp-content directories.
• Logs:
  • PHP error logs showing unlink() failures or warnings.
  • Web server access logs with suspicious POST requests to admin-ajax.php.

Detection Engineering

YARA Rule

rule CVE_2026_40779_Link_Library_File_Deletion {
    meta:
        description = "Detects exploitation attempts of CVE-2026-40779 in WordPress Link Library plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-40779"
    strings:
        $ajax_action = "link_library_delete_file"
        $path_traversal = "../"
        $file_path_param = "file_path"
    condition:
        $ajax_action and $path_traversal and $file_path_param
}

Sigma Rule

title: CVE-2026-40779 - Link Library Arbitrary File Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2026-40779 via path traversal in file_path parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=link_library_delete_file'
        cs-uri-query|contains: 'file_path='
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate file deletion by administrators (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-40779 - Link Library Arbitrary File Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=link_library_delete_file"; http_client_body;
    content:"file_path="; http_client_body;
    content:"../"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2026-40779;
)

Remediation & Mitigation

1. Immediate Action: Disable the Link Library plugin until a patched version is released.
2. Virtual Patching: Add the following rule to your WAF (e.g., ModSecurity):

SecRule REQUEST_URI "/wp-admin/admin-ajax.php" \
    "chain,id:1001,deny,msg:'CVE-2026-40779 Exploit Attempt'"
SecRule REQUEST_BODY "action=link_library_delete_file" \
    "chain"
SecRule REQUEST_BODY "file_path=.*\.\." \
    "t:urlDecode"

3. File Permissions: Ensure the web server user (e.g., www-data) does not have write permissions to critical files like wp-config.php.
4. Monitoring: Implement file integrity monitoring for the WordPress root directory.
5. Update: Subscribe to the plugin's changelog and apply updates immediately when available.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert