Skip to content
Heist/ feed
Unrated

Link Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation

Type: advisorySource: Official CVE List1 source record

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled.

Announced Source revision 1
Original source ↗

CVE-2026-78397

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-78397

Link Library

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Unknown",
    "product": "Link Library",
    "versions": [
      {
        "status": "affected",
        "version": "7.8.8",
        "lessThan": "7.9.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-78397

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#2028 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement