The Simple Link Directory Pro plugin for WordPress contains an SSRF vulnerability that could allow an unauthenticated attacker to force the server to make unauthorized network requests.

The plugin is susceptible to Server Side Request Forgery (CWE-918) via unauthenticated inputs. This allows the server to be manipulated into interacting with internal or external resources, as indicated by the CVSS scope change (S:C).

Successful exploitation allows an attacker to probe internal network services, bypass firewalls, or interact with external services while appearing to originate from the web server. With a CVSS score of 7.2, this vulnerability poses a significant risk to the security of the internal network infrastructure.

Immediate Action: Update the Simple Link Directory Pro plugin to version 15.0.7 or later to sanitize input and prevent unauthorized requests.

Proactive Monitoring: Monitor server egress traffic and logs for unexpected outbound connections, particularly those targeting internal IP addresses or sensitive network services.

Compensating Controls: Restrict server network access to only necessary external endpoints via egress filtering, and deploy a WAF to block malformed requests containing external URLs.

Public Exploit Available: No

Given the potential for internal network discovery and abuse, immediate remediation is required. Administrators must ensure the plugin is updated to the latest version to prevent the server from being leveraged as a proxy for malicious activity.