Link Library exposes an unauthenticated SQL injection
Link Library before 7.9.3 passes an unauthenticated user-supplied value into a SQL query without adequate sanitization or escaping. An unauthenticated attacker can alter the query and extract or modify database data according to the database account's permissions. The CNA record does not disclose the endpoint, parameter, query, vulnerable function or confirmed obtainable fields.
- Component
- Link Library
- Plugin slug
link-library- Affected
- < 7.9.3
- Safe version
7.9.3- Published
- Aug 03, 2026
This CVE was published Aug 03, 2026 and is one of 21 known issues for this plugin.
Update, patch or deactivate.
Update Link Library to 7.9.3 or later. Review requests for SQL-injection patterns and rotate WordPress salts, database credentials and other stored secrets if exploitation is suspected.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N