CVE-2026-15413

Published: Aug 13, 2026Modified: Aug 26, 2026Deferred

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: contact@wpscan.com (Secondary)

Description

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).

Related CWEs

CWE-912

Hidden Functionality

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

References (1)

https://wpscan.com/vulnerability/4cad269d-0146-4ca9-a1ae-55f02c8e5433/

Source: contact@wpscan.com

Timeline

No history available yet.