CVE-2025-8594: 
WordPress vulnerability analysis and mitigation

The Pz-LinkCard WordPress plugin (versions before 2.5.7) contains a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2025-8594. The vulnerability was discovered on September 23, 2025, and stems from the plugin's failure to validate a parameter before making requests, allowing users with Contributor-level privileges or higher to perform SSRF attacks (WPScan, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 3.8 (Low) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. The issue is classified as a Server-Side Request Forgery (SSRF) vulnerability and falls under the OWASP Top 10 category A1: Injection and CWE-918 (WPScan, Rapid7).

The vulnerability allows authenticated attackers with Contributor-level access or higher to make web requests to arbitrary locations originating from the web application. This capability can be exploited to query and modify information from internal services (Rapid7).

A proof of concept exists using the following code: [blogcard url='http://127.0.0.1:8082/poc12'][/blogcard]. The vulnerability requires authentication with at least Contributor-level access to exploit (WPScan).

Users should upgrade to Pz-LinkCard version 2.5.7 or later, which contains the fix for this vulnerability (WPScan).