The vulnerability is a Server Side Request Forgery flaw in the WordPress Link Library plugin. An attacker can cause the server to fetch arbitrary URLs, potentially accessing internal network resources or exfiltrating data. This flaw maps to CWE‑918 and can lead to confidentiality breaches and restrict integrity of remote resources. No direct code execution is provided, but unintended requests could expose sensitive information or enable further attacks.

WordPress sites running the Link Library plugin from version 7.8.7 or earlier are affected. The plugin, developed by Yannick Lefebvre, is used to manage link collections in WordPress installations. No specific environment constraints are listed, so any WordPress installation including the vulnerable plugin version is at risk.

The CVSS score of 4.9 indicates moderate risk. The EPSS score of less than 1% suggests the likelihood of exploitation is very low at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to inject a malicious link or otherwise influence the plugin to process a crafted URL; thus the exploit vector is likely through authenticated or unauthenticated content submission. Given the moderate severity and low exploitation probability, the overall risk is moderate but still warrants monitoring.