blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-78397

MEDIUM 4.0 CVSS 3.1
Published
September 25, 2026
Last modified
September 25, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-918
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Description

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Link Library — From 7.8.8 (including) to 7.9.6 (excluding)

References

  • wpscan.com https://wpscan.com/vulnerability/7842ef44-582c-40a8-8f3c-cf8abebaf7fb/
  • nvd.nist.gov Official NVD record