A critical path traversal vulnerability in the Link Library WordPress plugin allows unauthenticated attackers to delete arbitrary files, potentially leading to remote code execution.

This is a path traversal vulnerability (CWE-22) resulting from insufficient file path validation. It allows an unauthenticated attacker to delete arbitrary files if the administrator has enabled the specific plugin option for local file deletion.

Successful exploitation can result in the deletion of critical system or application files, such as wp-config.php, which may lead to a complete site takeover or remote code execution. With a CVSS score of 9.1, this represents a severe threat to data integrity and system availability, necessitating immediate attention.

Immediate Action: Update the Link Library plugin to version 7.9.5 or later immediately.

Proactive Monitoring: Review web server access logs for unusual requests directed at file deletion endpoints or attempts to access restricted system files.

Compensating Controls: Disable the "Delete local file on link deletion" option within the plugin settings until the update is applied to mitigate the primary attack vector.

Public Exploit Available: No.

Given the critical nature of this flaw and the potential for remote code execution, administrators must prioritize updating the Link Library plugin. Ensure all plugins are kept at their latest versions to prevent exploitation of known path traversal mechanisms.