CVE-2024-0677: 
WordPress vulnerability analysis and mitigation

The Pz-LinkCard WordPress plugin through version 2.5.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The plugin fails to implement proper restrictions on users pinging arbitrary hosts through its shortcodes, potentially allowing high-privilege users such as contributors to perform SSRF attacks (WPScan).

The vulnerability exists in the plugin's shortcode functionality that allows pinging external hosts. When a contributor or higher privileged user creates a post with certain shortcodes, they can specify arbitrary URLs to be pinged, including internal network addresses. This can be exploited through shortcodes like [blogcard url="http://127.0.0.1:9000"], which will trigger a request to the specified internal server when the draft is saved (WPScan).

The vulnerability could allow authenticated users with contributor-level privileges or higher to perform Server-Side Request Forgery attacks. This could potentially lead to unauthorized access to internal systems or services that should not be accessible from external networks (WPScan).

The vulnerability has been confirmed to be exploitable by users with contributor-level access or higher. A proof of concept exists demonstrating that internal servers can be reached by setting up a listener on a localhost/LAN host and using the vulnerable shortcode in a post draft (WPScan).

The vulnerability has been fixed in version 2.5.3 of the Pz-LinkCard plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).