Blog A plugin that is itself the backdoor, and a W3 Total Cache XSS fix
A plugin that is itself the backdoor, and a W3 Total Cache XSS fix
The link-factory plugin ships an operator-controlled REST API authenticated by a hardcoded Ed25519 key, and W3 Total Cache patches a stored XSS reachable through comment author names when its Lazy Load feature is enabled.
The most straightforward WordPress compromise is the one where the plugin is the malware. link-factory, described in CVE-2026-15413 and marketed as a “homepage sentence publisher”, ships with an operator-controlled REST API mounted under /wp-json/link-factory/v1/. Every route except the health check is gated by a detached Ed25519 signature verified against a public key baked into the plugin, which means the person holding the matching private key — not the site owner — decides what happens on the endpoint. There is no vulnerability to patch here. There is a plugin, and the plugin is the backdoor.
The rest of the day’s fixes are the more familiar shape: an authorisation mistake, an injection, a stored XSS.
wishlist-member up to 3.34.1 checks a registration cookie against the GET reg parameter but then trusts POST mergewith and wpm_id values without confirming that mergewith refers to the account the cookie was issued for. An unauthenticated visitor can attach a fresh registration to somebody else’s user ID and take over the account (CVE-2026-12949).
essential-addons-for-elementor before 6.7.2 lets a registration form overwrite reserved account attributes when the site has a custom profile field with a particular label. That is enough for an unauthenticated visitor to register directly as an administrator (CVE-2026-18039). Patched in 6.7.2.
paymob-for-woocommerce before 4.1.9 accepts a client-supplied identifier in its public payment callback and drops it into a SQL query before the HMAC signature from the payment provider is checked. Unauthenticated SQL injection in front of the signature verification is roughly the worst place to put one (CVE-2026-15205). Patched in 4.1.9.
w3-total-cache up to 2.10.3, installed on roughly 900,000 sites, fails to escape the comment author name when its Lazy Load feature is enabled, leaving stored XSS that runs whenever the injected page loads (CVE-2026-18109). Patched in 2.10.5.
The link-factory case is the one worth staring at. A plugin whose entire purpose is to hand a remote operator authenticated code paths is not something a WAF signature or an outdated-version scan catches — the code has no CVE against a “vulnerable” version because nothing is broken, and the traffic looks like ordinary REST calls signed by whoever wrote the plugin. Finding it means recognising the plugin itself, not a bug in it.
For sites that want a scanner built for exactly this kind of plugin compromise, Segurium is available on the official directory at wordpress.org/plugins/segurium/.
Share this post
Tags: #wordpress , #plugin , #cve , #supply-chain , #exploit