CVE-2026-25310

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25310", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-02T12:20:39.016Z", "datePublished": "2026-02-19T08:26:53.599Z", "dateUpdated": "2026-04-28T16:14:54.726Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "extend-link", "product": "Extend Link", "vendor": "Alobaidi", "versions": [{"changes": [{"at": "2.0.1", "status": "unaffected"}], "lessThanOrEqual": "2.0.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "theviper17 | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:02.730Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.<p>This issue affects Extend Link: from n/a through <= 2.0.0.</p>"}], "value": "Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.This issue affects Extend Link: from n/a through <= 2.0.0."}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "Server Side Request Forgery"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:54.726Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/extend-link/vulnerability/wordpress-extend-link-plugin-2-0-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"}], "title": "WordPress Extend Link plugin <= 2.0.0 - Server Side Request Forgery (SSRF) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T20:36:36.647936Z", "id": "CVE-2026-25310", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T12:53:24.547Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25310", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T20:36:36.647936Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T20:35:40.488Z"}}], "cna": {"title": "WordPress Extend Link plugin <= 2.0.0 - Server Side Request Forgery (SSRF) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "theviper17 | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "Server Side Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Alobaidi", "product": "Extend Link", "versions": [{"status": "affected", "changes": [{"at": "2.0.1", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "2.0.0"}], "packageName": "extend-link", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-28T13:26:38.704Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/extend-link/vulnerability/wordpress-extend-link-plugin-2-0-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.This issue affects Extend Link: from n/a through <= 2.0.0.", "supportingMedia": [{"type": "text/html", "value": "Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.<p>This issue affects Extend Link: from n/a through <= 2.0.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T12:10:48.847Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25310", "state": "PUBLISHED", "dateUpdated": "2026-04-28T12:53:24.547Z", "dateReserved": "2026-02-02T12:20:39.016Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-19T08:26:53.599Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "extend-link", "product": "Extend Link", "vendor": "Alobaidi", "versions": [{"changes": [{"at": "2.0.1", "status": "unaffected"}], "lessThanOrEqual": "2.0.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.This issue affects Extend Link: from n/a through <= 2.0.0."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en Alobaidi Extend Link extend-link permite la falsificaci\u00f3n de petici\u00f3n del lado del servidor. Este problema afecta a Extend Link: desde n/a hasta &lt;= 2.0.0."}], "id": "CVE-2026-25310", "lastModified": "2026-06-17T10:24:24.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.7, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25310", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T20:36:36.647936Z", "version": "2.0.3"}}]}, "published": "2026-02-19T09:16:15.200", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/extend-link/vulnerability/wordpress-extend-link-plugin-2-0-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[2.0.1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Extend Link", "source": "cna", "vendor": "Alobaidi"}, "product": "extend_link", "vendor": "alobaidi"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T17:00:23.912747+00:00", "value": {"mitigation_remediation": ["Upgrade the Alobaidi Extend Link plugin to a version newer than 2.0.0", "Configure the plugin or the web server to block Server Side Request Forgery attempts by whitelisting allowed domains and blocking internal IP ranges", "If an update cannot be applied immediately, temporarily disable or delete the plugin to eliminate the vulnerability"], "summary": {"action": "Patch", "impact": "Server Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The affected product is the WordPress Extend Link plugin from the Alobaidi vendor. Versions up to and including 2.0.0 are impacted; newer releases are presumed to have the fix.", "description_and_impact": "A Server Side Request Forgery flaw exists in the Alobaidi Extend Link WordPress plugin. The vulnerability allows an attacker to cause the web server to send arbitrary HTTP requests to internal or external addresses that the attacker specifies. The attacker can potentially extract sensitive data, compromise internal services, or use the server as a proxy or launch further attacks. This issue is classified as CWE\u2011918.", "risk_and_exploitability": "The CVSS base score of 4.9 indicates moderate severity. The EPSS score is under 1%, suggesting a very low likelihood of exploitation at the present time, and the vulnerability is not listed in the CISA KEV catalog. While the attack vector is not fully documented in the report, it is inferred that the flaw is triggered by supplying a malicious URL or remote resource reference through the plugin\u2019s input mechanisms, likely requiring authenticated access to the WordPress administrative interface. If exploited, the attacker could read internal data or pivot to other systems via the web server."}}}}, "created": "2026-02-20T10:09:10.934416+00:00", "updated": "2026-04-16T17:15:17.970428+00:00", "vendors": ["alobaidi", "alobaidi$PRODUCT$extend_link", "wordpress", "wordpress$PRODUCT$wordpress"]}