The Link Library WordPress plugin contains an SSRF vulnerability that could permit unauthorized internal network interactions.

The plugin contains an SSRF flaw that allows an attacker to force the server to make unauthorized requests to internal or external resources. The vulnerability requires some level of authentication (PR:L) and high attack complexity (AC:H).

SSRF vulnerabilities can be leveraged to bypass network segmentation, scan internal services, or interact with cloud metadata services, leading to potential data exfiltration. Although the CVSS score is 9.1, the Wordfence-provided score of 6.4 more accurately reflects the required authentication and complexity, categorizing this as a moderate but persistent threat to WordPress environments.

Immediate Action: Update the Link Library plugin to version 7.8.8 or later immediately.

Proactive Monitoring: Review web server access logs for requests originating from the server to unusual internal IP addresses or sensitive local ports.

Compensating Controls: Ensure the web server is configured with the principle of least privilege, specifically restricting outbound network access to only necessary external endpoints.

Public Exploit Available: Unknown.

Users of the Link Library plugin should update to version 7.8.8 without delay to resolve the SSRF vulnerability. Regular patching of third-party plugins is essential to maintain the security posture of the underlying WordPress installation and the hosting environment.