CVE-2026-18855

CVE-2026-18855 in the Link Library plugin allows arbitrary file deletion through a feature that removes local files when links are permanently deleted. The technical impact is severe—deletion of wp-config.php enables complete site compromise—but exploitation requires two specific conditions: an administrator must first enable the 'Delete local file on link deletion' option, then must actually delete a link containing a crafted file path. This creates a social-technical attack chain rather than a direct exploit. The CVSS 9.1 rating captures the theoretical impact ceiling accurately, but the EPSS score of 0.01206 better reflects the actual exploitation floor. The gap between these numbers is not a scoring methodology problem—it reflects a fundamental truth about this vulnerability class. The 'disabled by default' qualifier often used to justify lower severity here obscures a critical point: enabling this feature requires a single checkbox, and the triggering action (deleting a link) is routine administrative workflow. The distance between 'default secure' and 'exploitable' is trivial. More concerning is the temporal dimension most severity frameworks ignore. The 'administrator must enable feature' prerequisite assumes institutional memory persists—that someone will always remember this checkbox is dangerous. It isn't. When the admin who enabled the option leaves, when the Slack thread explaining the risk gets deleted, when the plugin sits unmaintained in the repository for years, the vulnerable configuration becomes archaeological—discoverable by anyone who excavates it, invisible to everyone else. Defenders should weight EPSS probability over CVSS impact for prioritization, but not because the impact ceiling is wrong. Rather, because the attack chain reveals systemic conditions—plugin feature bloat, WordPress's implicit admin trust model, path handling without sanitization in file operations—that are producing entire vulnerability classes. Patching this CVE doesn't address the ecosystem pressures that generated it. For immediate action: audit any WordPress installation running Link Library for whether the 'Delete local file on link deletion' option is enabled and disable it if present. If the plugin is unused, remove it entirely. The vulnerability persists in the codebase even when disabled, and the 'disabled by default' snapshot is not a permanent security boundary—future code changes or plugin death can re-expose the attack surface.

Reviewed through automated stages and approved by a human before publication.