Link Library EUVD-2026-86529

Non-default configuration required: the site owner must have published the plugin's public link submission form AND enabled reciprocal-link validation, which is the code path that performs the outbound fetch. The vulnerable behavior only manifests when the plugin's protected/safe request is rejected and it falls back to an unprotected fetch, so exploitation is conditional on that fallback being reached (reflected in AC:H). Affected versions are Link Library 7.8.8 through 7.9.5 (installations below 7.8.8 fall under CVE-2025-68600; 7.9.6 is fixed). No authentication or user interaction is needed (PR:N/UI:N), but sites without the submission form or with reciprocal-link validation disabled are not exposed.

This is a genuinely low-priority issue despite being a network-exploitable, unauthenticated flaw. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N, base 4.0) is internally consistent with the description: it is remotely reachable and needs no authentication, but AC:H reflects that the vulnerable path only triggers under a specific plugin configuration and only after the plugin's protected/safe request is rejected, and the impact is limited to C:L (a boolean oracle revealing whether an internal service responded) with no integrity or availability impact. All exploitation signals reinforce low real-world risk: EPSS is 0.13% (2nd percentile), it is NOT on CISA KEV, and there is no evidence of active exploitation. A public exploit does exist (publicly available exploit code exists, published by WPScan), which raises reproducibility but must not be conflated with active exploitation - the two signals are distinct here. The CVSS vector and description agree (both indicate remote/unauthenticated SSRF), so no conflict needs flagging. The one nuance is that this is an incomplete-fix follow-up to CVE-2025-68600 (which covered versions below 7.8.8); this entry covers 7.8.8-7.9.5, so operators who believed they were patched by the earlier fix remain exposed until 7.9.6.

An unauthenticated visitor submits a crafted URL pointing at an internal host (e.g., a private RFC1918 address or localhost service) through the plugin's public reciprocal-link submission form. When the plugin's safe/protected request is rejected, it falls back to an unprotected fetch, and the differing response behavior tells the attacker whether an internal service answered, enabling internal network/port mapping. A public proof-of-concept from WPScan exists, though the high attack complexity (specific enabled configuration) limits scope.