---
id: CVE-2026-78395
title: >-
  Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement
  Bypass
summary: >-
  The Link Library WordPress plugin before 7.10.0 does not re-check the selected
  library's own login requirement when processing its front-end link submission,
  allowing unauthenticated users to submit links to a library configured to
  requi…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-862
product: Link Library
affected:
  - link_library < 7.10.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-29T10:52:46.891776Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T10:56:08.732Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-78395'
references:
  - url: 'https://wpscan.com/vulnerability/e2cf7d5f-b9c9-4320-9fc8-4ac8c6d24f78/'
tags:
  - cve.org
epss: 0.00182
epssPercentile: 0.07825
ingestedAt: '2026-11-01T17:57:46.224Z'
---

## Overview

The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.

## Affected

- `link_library < 7.10.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.