The Link Factory WordPress plugin is confirmed to be a malicious backdoor that grants unauthorized administrative control over the affected website.

This plugin functions as a backdoor, exposing an operator-controlled REST API at /wp-json/link-factory/v1/. Access is authenticated via a detached Ed25519 signature verified against a hardcoded public key, effectively providing a permanent, unauthorized access channel for the plugin author or any actor possessing the private key.

The presence of a backdoor constitutes a total compromise of the affected WordPress site, allowing an attacker to manipulate site content, access sensitive database records, and execute arbitrary code. The CVSS score of 10.0 reflects the absolute severity of a system that contains intentional, hidden administrative access.

Immediate Action: Immediately deactivate and uninstall the Link Factory plugin from all WordPress instances.

Proactive Monitoring: Perform a comprehensive forensic audit of the site, including a review of all user accounts, plugin directories, and database entries, to identify any unauthorized changes made through the backdoor.

Compensating Controls: Implement file integrity monitoring (FIM) to detect unauthorized changes to the WordPress core or plugin files, and restrict access to the /wp-json/ directory via server-level configurations if possible.

Public Exploit Available: Unknown

This plugin should be treated as malware and removed immediately. Organizations should conduct a full security assessment of any system where this plugin was installed, as the backdoor may have been used to install additional persistent threats or compromise sensitive data.