The vulnerability in the Link Library WordPress plugin (versions before 7.10.0) occurs because the plugin does not confirm that a link belongs to the settings set whose display template is used. As a result, unauthenticated users can retrieve telephone numbers, e‑mail addresses, and submitter names that should be hidden, leading to a disclosure of sensitive contact information.

Any WordPress site that has the Link Library plugin installed with a version earlier than 7.10.0 is affected. The vulnerability applies to all settings sets configured not to display contact details.

The flaw allows unauthenticated users to view restricted contact information, constituting an information‑disclosure attack. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through direct HTTP requests to the plugin’s link rendering endpoints, and no authentication is required to exploit it. The severity of the impact is primarily confidentiality loss of personal contact data.