The Simple Link Directory Pro plugin in versions up to 15.0.6 accepts user supplied URLs and issues HTTP/S requests on behalf of the server. This unauthenticated Server Side Request Forgery allows an attacker to trigger the site to fetch arbitrary external or internal resources, potentially revealing data that the server can access. The flaw does not enable direct code execution or unauthorized privilege escalation.

The vulnerability exists in the QuantumCloud Simple Link Directory Pro WordPress plugin, affecting all releases from the initial version up to and including 15.0.6. WordPress sites that have installed any of these versions are susceptible until the plugin is updated to version 15.0.7 or later.

The CVSS score of 7.2 indicates a high severity for an unauthenticated SSRF that can request arbitrary resources. The EPSS score shows a very low probability of exploitation at present. The issue is not listed in the CISA KEV catalog. Because the plugin accepts URL input from any visitor, the likely attack vector is an unauthenticated HTTP request to the plugin’s public interface that supplies a crafted URL, meaning the vulnerability is broadly exploitable on any site with the vulnerable plugin installed.