The Visual Link Preview plugin exposes an SSRF flaw that lets an attacker cause the server to make arbitrary HTTP requests. The vulnerability is based on CWE‑918 and can lead to unauthorized access to internal resources, data leaks, or further compromise of the hosting environment. The flaw would allow malicious endpoints to be contacted without any restriction, potentially exposing confidential system details to an attacker.

WordPress sites that have the Brecht Visual Link Preview plugin installed at version 2.3.0 or earlier are affected. Any site using that plugin, regardless of its WordPress core version, could be vulnerable.

The CVSS score of 6.0 indicates medium severity. An EPSS score of less than 1% suggests that exploitation is currently unlikely in the broader ecosystem. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s link preview feature, which can be triggered by users who can supply arbitrary URLs. Exploitation would require the attacker to supply a crafted URL that redirects the server to an internal or otherwise unintended target.