Server-Side Request Forgery in Pz-LinkCard WordPress Plugin
CVE-2025-8594
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 14 October 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-8594?
The Pz-LinkCard WordPress plugin versions before 2.5.7 are susceptible to a server-side request forgery (SSRF) vulnerability. This issue arises from insufficient validation of input parameters, potentially allowing users with minimal permissions, such as those with the Contributor role, to craft malicious requests that could lead to unauthorized access to internal resources. It is crucial for website administrators using this plugin to update to the latest version to mitigate this risk and safeguard their systems.
Affected Version(s)
Pz-LinkCard 0 < 2.5.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.