WordPress Plugin Vulnerabilities

Link Library < 7.8.8 - Authenticated (Contributor+) Server-Side Request Forgery

Description

The Link Library plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.8.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
link-library
Fixed in 7.8.8

References

CVE
CVE-2025-68600
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/d0ec9b5f-84c2-4736-98fb-130215430b8c

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.5 (Medium)

Miscellaneous

Original Researcher
Krissaphat Jankaew
Verified
No
WPVDB ID
bb4a78a5-8f4d-4679-a3e1-79d587d51a99

Timeline

Publicly Published
2025-12-24 (about 6 months ago)
Added
2026-01-06 (about 5 months ago)
Last Updated
2026-04-14 (about 2 months ago)

Other

Published
Title
Published
2025-01-24
Title
Comment Edit Core – Simple Comment Editing < 3.1.0 - Authenticated (Admin+) Server-Side Request Forgery
Published
2024-06-20
Title
WP Scraper < 5.8.1 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2024-03-27
Title
CMP – Coming Soon & Maintenance < 4.1.11 - Authenticated (Admin+) Server-Side Request Forgery
Published
2025-12-04
Title
Time Sheets <= 2.1.3 - Use of Known Vulnerable Component
Published
2026-06-23
Title
URL Preview <= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter