Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-15413

Link Factory - Backdoor

Description

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Link Factory

Default version status: unknown

  • 0 to ≤ *affected

References