The Link Library WordPress plugin does not validate the destination of a user‑supplied URL when reciprocal‑link validation is enabled and the safe request fails. An unauthenticated visitor can cause the site to issue requests to arbitrary internal hosts. The responses to these requests are returned to the attacker, allowing discovery of internal services or extraction of sensitive data. This represents a server‑side request forgery flaw as defined by CWE‑918, and because external hosts learn internal service responses it also results in information exposure (CWE‑200).

WordPress plugin Link Library versions 7.8.8 through 7.9.5 are vulnerable. Versions older than 7.8.8 are addressed by CVE‑2025‑68600, and 7.9.6 or later includes the necessary validation fix.

The vulnerability is exploitable by any unauthenticated user who can submit a link via the public form with reciprocal‑link validation enabled. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but SSRF issues are commonly exploited. Successful exploitation would allow an attacker to probe the internal network and potentially identify services that could be further attacked if additional weaknesses exist. The lack of a public exploit or advisory means the exploitation thus far is likely in the developmental or proof‑of‑concept stage, yet the potential impact of internal data exposure remains high.