Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor account on target WordPress
-
DeliverySubmit crafted URL in plugin parameter
-
ExploitPlugin issues unvalidated server-side request
-
ExecutionReach internal/metadata endpoints
-
ImpactExfiltrate limited internal data
Vulnerability Assessment
| Exploitation Conditions | Requires an authenticated WordPress account with at least Contributor role on a site running the Pz-LinkCard plugin before version 2.5.7; the attacker supplies a parameter value that the plugin uses to issue a server-side HTTP request without validation. Exploitation is limited by the need for valid credentials (so sites that disable open/Contributor registration raise the bar significantly) and by the plugin being installed and active. No end-user interaction is required beyond the attacker's own authenticated submission. |
| Impact | This is a low-priority vulnerability by every available signal. The CVSS base score is only 3.8 (Low), reflecting authenticated access (PR:H in the supplied vector), limited confidentiality/integrity impact (C:L/I:L), and no availability impact. The EPSS score is 0.19% (8th percentile), indicating very low predicted likelihood of exploitation. There is no CISA KEV listing and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. One notable conflict exists: the supplied CVSS vector uses PR:H (high privileges), yet the description states the flaw is exploitable by a user 'with a role as low as Contributor,' which is a low-privilege WordPress role and would normally map to PR:L - verify with WPScan, as this affects whether the real barrier to entry is lower than the headline vector suggests. SSRF in a low-adoption content plugin, gated behind an authenticated account, represents a genuine but minor risk best handled through routine patching rather than emergency response. |
| Exploit ScenarioDerived | An attacker who holds (or registers) a Contributor-level account on a WordPress site running Pz-LinkCard before 2.5.7 submits a crafted value in the plugin parameter that is passed, unvalidated, into a server-side request. The plugin fetches the attacker-supplied URL, letting the attacker probe internal network services or cloud metadata endpoints and read limited responses. No public proof-of-concept is referenced, and exploitation requires an authenticated low-privilege account rather than anonymous access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Server-side request forgery in the Pz-LinkCard WordPress plugin before version 2.5.7 allows a user with as little as Contributor privileges to make the site's server send HTTP requests to an attacker-influenced destination, because a request parameter is used to build an outbound request without validation. The independent assessment rates this as low severity (CVSS 3.1 base 3.8, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), and the EPSS score of 0.19% (8th percentile) reinforces that real-world exploitation is unlikely; no exploit code and no CISA KEV entry have been identified at time of analysis. Risk is concentrated on sites that leave the plugin active and allow open or low-privilege registration, since a valid Contributor account is a prerequisite.
RemediationAI
The primary fix is to update the Pz-LinkCard plugin to version 2.5.7 (vendor-released patch, per the 'before 2.5.7' advisory range); this is a drop-in plugin upgrade with no expected configuration side effects and should be applied through the WordPress admin or WP-CLI. If the plugin is not essential, deactivating and deleting it removes the attack surface entirely. Where immediate upgrading is not possible, the most effective compensating control is tightening who can reach the vulnerable feature: disable open registration and audit existing Contributor and higher accounts, since the flaw requires an authenticated low-privilege user, though this has the operational cost of blocking legitimate new contributors. Site owners can also add a WAF rule that blocks outbound-preview requests carrying internal or loopback addresses, or restrict the vulnerability-bearing AJAX/REST action to trusted roles via a plugin or capability filter, but such filters can break the link-card functionality for legitimate editors. On the network side, configuring the web server or host firewall with an egress allow-list that denies access to RFC1918 ranges, 169.254.169.254 metadata endpoints, and localhost reduces SSRF blast radius across all plugins, at the trade-off of potentially breaking any feature that legitimately fetches internal services. Monitor the WPScan advisory for updated guidance.
Affected ProductsAI
The WordPress plugin Pz-LinkCard at all versions before 2.5.7 (i.e., up to and including 2.5.6) is affected; version 2.5.7 is the vendor-released fix. The plugin must be installed and active on a WordPress site, and the attacker must hold a valid account with at least the Contributor role, which means installations with open registration or with weak Contributor onboarding are the primary exposure. No CPE strings were provided with the source data, so version filtering should rely on the plugin slug and version rather than NVD CPE matching. The authoritative vulnerability record is the WPScan advisory at https://wpscan.com/vulnerability/17104590-d84e-41b7-83ac-9b15fcfb537a/, which is the only reference supplied and should be consulted for the vendor's own affected-version confirmation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic server-side request forgery (SSRF, CWE-918 family, though no CWE was supplied in the source data) in the WordPress plugin Pz-LinkCard, a link-preview/card rendering component. The plugin takes a user-supplied parameter and uses it as the target of a server-side HTTP fetch, presumably to retrieve metadata such as titles or images for the link card, without validating or restricting the destination address. Because the request originates from the web server rather than the client, an attacker can pivot to internal-only services, cloud instance metadata endpoints, or other hosts reachable from the WordPress server's network position. The vendor-assigned vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N (3.8) while the independent assessment lowers the privilege requirement to PR:L, matching the description's statement that a Contributor-level user suffices; WordPress Contributor accounts are commonly the lowest role that can author content and interact with plugin features. Impact is bounded to low confidentiality and integrity hits with no availability effect, which is consistent with an SSRF that can only be triggered after authentication and returns no direct response to the attacker beyond what the plugin surfaces.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Network-reachable and low-complexity, but the description's 'as low as Contributor' indicates a low-privilege authenticated account (PR:L, not PR:H); SSRF yields limited read and request-forging impact (C:L/I:L).
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
DescriptionCVE.org
The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contributor to perform SSRF attack.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
GitHub PoC
Exploit-DB