Critical Backdoor in WordPress Plugin Exposes Enterprise Sites to Remote Code Execution
Overview
CVE-2026-15413 reveals a supply-chain backdoor in the Link Factory WordPress plugin, enabling unauthenticated remote code execution via a REST API secured with a hardcoded cryptographic key. Sites using this deceptive plugin are fully compromised, risking data exfiltration and site takeover.
Technical Analysis
The backdoor exposes a REST API at /wp-json/link-factory/v1/, authenticated via Ed25519 signatures verified against a hardcoded public key (except for the health check endpoint). Attackers can generate valid signatures using the operator's private key to execute arbitrary commands, bypassing standard WordPress authentication mechanisms. This design flaw allows remote code execution with no user interaction, leveraging the plugin's deceptive distribution as a 'homepage sentence publisher'.
Enterprise & DIB Impact
Defense Industrial Base (DIB) and enterprise WordPress deployments face imminent risk of full system compromise, data breaches, and supply-chain exploitation. Attackers could leverage this backdoor to establish persistent access, lateral movement, or deploy ransomware, targeting critical infrastructure and proprietary systems.
Recommended Actions
- Remove the Link Factory plugin immediately
- audit WordPress plugin inventories for unauthorized components
- monitor REST API traffic for signed requests to /wp-json/link-factory/v1/
- implement hardened WordPress security configurations via plugins like Wordfence or iThemes Security
- and report findings to your organization's CERT or US-CERT.
Need Help Assessing Your Exposure?
Axiom Cyber Research provides vulnerability assessment, red team operations, and security advisory services to the Defense Industrial Base and regulated sectors.
Schedule a ConsultationFull security advisory on 247alerts.net →