Strix
75.6K

CVE-2026-78397

MEDIUMCVSS 4/10

Last modified

CVE-2026-78397 is a medium-severity vulnerability rated 4/10 on the CVSS scale. The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled..

Description

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled.

Metrics

CVSS 3.1
4/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
UnknownLink Library>= 7.8.8, < 7.9.6

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2026-78397?
The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled.
How severe is CVE-2026-78397?
CVE-2026-78397 has a CVSS score of 4/10 (MEDIUM severity).
How do I fix CVE-2026-78397?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-78397?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST