Link Factory WordPress Plugin Backdoor Analysis (CVE-2026-15413)

Vulnerability Overview Vulnerability Name: Link Factory - Backdoor Description: This plugin acts as a backdoor, distributed under the guise of a "Homepage Sentence Publisher." It exposes a REST API controlled by the operator (endpoint ) that is authenticated via Ed25519 signatures verified against a hardcoded operator public key (with the exception of the health check endpoint). Capabilities: Allows the plugin's operator to perform the following without needing any WordPress account: - Create a hidden admin account with a randomly generated "if_" prefixed login and retrieve its credentials ( ), check for its existence, or delete it ( , ); - Publish articles authorized by the site administrator ( , ); - Inject operator-controlled HTML into a hidden, off-screen container within the site's footer for black-hat SEO/reverse link injection ( , ); - Fingerprint the presence and version of the plugin via an unauthenticated beacon ( ). Impact: Results in complete and persistent site compromise. The plugin's source code describes the admin channel as a "plugin-owned access path" that does not depend on seller credentials—meaning the operator retains administrative access to "donated" sites independently of the site owner. Affected Versions Affected Plugin: link-factory Known Fix: None Remediation Remediation Status: No known fix available Additional Information CVE ID: CVE-2026-15413 Original Researcher: Erwan LR (WPScan) Submitter: Erwan LR (WPScan) Verification Status: Verified WPVDB ID: 4cad269d-0146-4ca9-a1ae-55f02c8e5433 Publication Timeline: - Public Release: 2026-08-11 - Added: 2026-08-11 - Last Updated: 2026-08-11 Related Vulnerabilities Captcha 4.3.6-4.4.4 - Backdoored M-Shield & kingof - Fake Malware Backdoor Plugins No Follow All External Links 2.1.0-2.3.0 (current) - Backdoored Backdoored Plugins & Themes from AccessPress Themes Pipdig Power Pack < 4.8.0 - Vendor Backdoors & Suspicious Code Proof of Concept Proof of Concept Code: Specific POC code is not provided on the page; however, it is noted that the POC will be demonstrated on August 25, 2026, to allow users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

Link Factory WordPress Plugin Backdoor Analysis (CVE-2026-15413)