CVE-2025-8594

Pz-LinkCard < 2.5.7 - Contributor+ SSRF

The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contributor to perform SSRF attack.

Affected

Pz-LinkCard

CVSS v3.1 CNA

3.8 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

EPSS

0.23% chance of exploitation in the next 30 days, 13th percentile

Published

2025-10-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/17104590-d84e-41b7-83ac-9b15fcfb537a/

References

• CVE Record
• NVD entry