CVE-2026-78397: Link Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation
The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered.
Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Link Library WordPress pluginto a version that resolves this vulnerability.Fixed in 7.9.6
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using Link Library versions 7.8.8 through 7.9.5 are exposed only if the owner has published the plugin's public link submission form and enabled reciprocal-link validation. The issue can be exploited by unauthenticated visitors in that configuration.
What can an attacker do with successful exploitation?
An attacker can cause the WordPress site to send requests to hosts on its internal network. They can also learn from the response whether an internal service answered.
What should be prioritized for mitigation?
Update Link Library to version 7.9.6 or later. If updating cannot happen immediately, remove public access to the link submission form or disable reciprocal-link validation, since both are required for exploitation.