Description

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.0",
  "pubDate": "2026-09-25T07:16:54.530Z",
  "pubdate": "2026-09-25T07:16:54.530Z",
  "executiveSummary": "The Link Library WordPress plugin contains a Server-Side Request Forgery (SSRF) vulnerability due to improper input validation when processing user-supplied URLs.\nThis vulnerability allows unauthenticated attackers to force the web server to make arbitrary requests to internal network resources, potentially leading to unauthorized service discovery or interaction with internal APIs.\nThe issue affects versions of Link Library prior to 7.9.6, with specific focus on versions 7.8.8 through 7.9.5, which contained an incomplete fix for a previously identified SSRF flaw (CVE-2025-68600).\nSuccessful exploitation requires the site administrator to have enabled the public link submission form with reciprocal-link validation active.\nThe risk is significant as it grants remote, unauthenticated actors the ability to bypass network perimeters, effectively using the vulnerable WordPress installation as a proxy to probe internal infrastructure that is otherwise protected from the public internet.\nAttackers can leverage the application's response to infer the status of internal services, facilitating further reconnaissance or lateral movement within the target organization's network environment.",
  "technicalDetails": "The vulnerability originates from a failure to perform adequate input sanitization and destination validation within the Link Library plugin's URL handling logic. Specifically, the component responsible for performing reciprocal-link validation fails to maintain a robust 'safe request' enforcement policy.\nWhen a requested URL fails the initial safety checks, the plugin logic incorrectly defaults to an unprotected fetch mechanism. This fallback behavior lacks secondary filtering, allowing the application to resolve and request arbitrary domains, including those located within the local or private network (e.g., 127.0.0.1, 10.x.x.x, 172.16.x.x, 192.168.x.x).\nThe exploitation flow begins when an unauthenticated attacker accesses the publicly available link submission form. By injecting a target internal URL into the link field, the attacker triggers the server-side request functionality. Because the server does not enforce strict allow-lists or perform host validation during the fallback routine, the underlying PHP fetch function executes the request on behalf of the attacker.\nThis behavior constitutes a classic SSRF attack vector. By observing the HTTP response or the application's error messages triggered by the request, an attacker can determine if an internal service exists and how it responds to various inputs. For instance, the attacker can probe for common internal ports or services, such as database interfaces, administrative panels, or cloud metadata endpoints that might be accessible to the web server.\nThe technical core of the vulnerability in versions 7.8.8 through 7.9.5 is an 'incomplete fix' flaw, where the sanitization routine is bypassable or fails to account for alternative URI schemes or internal IP resolution techniques. Since the request is performed by the server itself, the attacker effectively gains the ability to circumvent firewall rules that prevent external access to internal services.\nThe impact is not limited to simple service discovery. If the internal services lack robust authentication—common in trusted internal environments—the attacker could theoretically perform unauthorized actions, read internal data, or potentially achieve remote code execution if internal services are vulnerable to request-based exploitation. The requirement that the site owner enables the public link submission form serves as the primary gateway for this unauthenticated entry point."
}