The vulnerability is a Server Side Request Forgery in the Visual Link Preview plugin, allowing an attacker to compel the server to issue requests to arbitrary URLs. This can expose internal network resources, retrieve confidential data, or interact with internal services without authentication. The flaw arises from insufficient validation of the URL input used for generating link previews.

The issue affects the Brecht Visual Link Preview WordPress plugin version 2.3.0 and earlier. Users running those versions are at risk.

No exploit probability score is publicly available and the vulnerability is not listed in the KEV catalog. Still, SSRF is a high-risk weakness that could be leveraged by attackers who can supply a crafted link to the plugin, for example via a post or comment. Although an exploit has not yet been observed in the wild, the potential to access internal services is significant. The attack surface is likely limited to authenticated or unauthenticated users depending on plugin configuration, but the risk remains high if the plugin processes URLs from untrusted input.