CVE-2026-15413: 
WordPress vulnerability analysis and mitigation

CVE-2026-15413 is a backdoor vulnerability in the Link Factory WordPress plugin, marketed as a "homepage sentence publisher." The plugin covertly exposes an operator-controlled REST API at /wp-json/link-factory/v1/ authenticated via a hardcoded Ed25519 public key, enabling the plugin's operator to fully compromise any WordPress site where it is installed — without requiring a WordPress account. All known versions of the plugin are affected; no fixed version has been identified. It was publicly disclosed on August 11, 2026, and assigned a CVSS v3.1 base score of 10.0 (Critical) (WPScan, GitHub Advisory).

The vulnerability is classified as CWE-912 (Hidden Functionality) — the plugin is intentionally designed as a supply-chain backdoor. The REST API endpoints under /wp-json/link-factory/v1/ are authenticated using a detached Ed25519 signature verified against a hardcoded operator public key embedded in the plugin code, meaning only the plugin's operator (not the site owner) can authenticate. The health check endpoint (GET /health) is entirely unauthenticated, allowing passive fingerprinting of affected installations. The plugin's own source code describes the administrator channel as a "plugin-owned access path that does not depend on seller credentials," confirming intentional design. A proof-of-concept is scheduled for public release on August 25, 2026, to allow time for remediation (WPScan, GitHub Advisory).

Exploitation grants the plugin operator full, persistent administrative control over any WordPress site running the plugin, entirely independent of the site owner's credentials. Specific capabilities include: creating hidden administrator accounts with lf_-prefixed logins and retrieving their credentials; publishing arbitrary posts as a site administrator; injecting operator-controlled HTML into a hidden footer container for black-hat SEO and backlink injection; and fingerprinting plugin presence and version via an unauthenticated beacon. The scope is changed (S:C), with high confidentiality, integrity, and availability impact, meaning compromise extends beyond the WordPress application itself to the underlying hosting environment and any data stored within (WPScan, GitHub Advisory).

No public proof-of-concept exploit is currently available; WPScan has stated it will be published on August 25, 2026. There is no confirmed evidence of in-the-wild exploitation at this time, and the EPSS score is 0.0. The vulnerability does not require any privileges or user interaction, and exploitation is trivially achievable by the plugin's operator using the hardcoded private key. The CVE has not been added to the CISA KEV catalog as of the disclosure date (WPScan, GitHub Advisory).

1. Fingerprint targets: Send an unauthenticated GET request to /wp-json/link-factory/v1/health on target WordPress sites to confirm the plugin is installed and retrieve its version without any credentials.
2. Authenticate as operator: Using the hardcoded Ed25519 private key (held by the plugin operator), generate a detached Ed25519 signature over the intended request payload.
3. Create a hidden admin account: Send a signed POST /wp-json/link-factory/v1/users request to create a hidden WordPress administrator account with a randomly generated lf_-prefixed username and retrieve its credentials.
4. Establish persistent access: Use the newly created administrator credentials to log into the WordPress admin panel (/wp-admin), install additional plugins, or create further backdoors for persistent access independent of the REST API.
5. Inject malicious content: Optionally, use POST /wp-json/link-factory/v1/sentences to inject operator-controlled HTML into the site footer for SEO manipulation or malicious link injection, or POST /wp-json/link-factory/v1/articles to publish arbitrary content as a site administrator (WPScan).

• Network: Unexpected HTTP requests to /wp-json/link-factory/v1/ endpoints, particularly POST /users, POST /articles, POST /sentences, or DELETE variants; unauthenticated GET requests to /wp-json/link-factory/v1/health from external IPs.
• WordPress User Accounts: Presence of WordPress administrator accounts with usernames beginning with lf_ that were not created by the site owner.
• File System: Presence of the link-factory plugin directory under wp-content/plugins/; review plugin files for hardcoded Ed25519 public key strings.
• Database: Unexpected posts or pages authored by administrator accounts, particularly those with lf_-prefixed usernames; hidden HTML content injected into footer widgets or theme files.
• Logs: WordPress and web server access logs showing API calls to /wp-json/link-factory/v1/ endpoints, especially from unfamiliar IP addresses or with unusual Authorization headers containing Ed25519 signatures (WPScan).

There is currently no known fixed version of the Link Factory plugin; the recommended action is to immediately remove the plugin from all WordPress installations. Site owners should audit their WordPress user accounts for any accounts with lf_-prefixed usernames and delete them. Review WordPress access logs for suspicious API calls to /wp-json/link-factory/v1/ endpoints and conduct a full security audit of the affected installation to identify unauthorized content changes or data access. Do not reinstall the plugin until a verified, clean version is released by a trusted source (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by Erwan LR of WPScan, who verified the finding and submitted it through WPScan's responsible disclosure process. WPScan has deliberately withheld the proof-of-concept until August 25, 2026, to provide site owners time to remediate. The case has drawn comparisons to other WordPress supply-chain backdoor incidents catalogued by WPScan, including the ShapedPlugin compromised update server (2026) and the Captcha plugin backdoor (2017), highlighting a recurring pattern of malicious plugins distributed through legitimate-seeming channels (WPScan).