{"id":"CVE-2026-78396","title":"Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure","summary":"The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail addres…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"adp","cwe":["CWE-200"],"product":"Link Library","affected":["link_library < 7.10.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-29T10:52:39.197421Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T10:56:08.584Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-78396","references":[{"url":"https://wpscan.com/vulnerability/0eab05a7-8426-40a6-b0ee-5ae3547b842a/"}],"tags":["cve.org"],"epss":0.00206,"epssPercentile":0.10754,"ingestedAt":"2026-11-01T17:57:46.225Z","slug":"CVE-2026-78396","body":"## Overview\n\nThe Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display.\n\n## Affected\n\n- `link_library < 7.10.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}