The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 19 Aug 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active. | |
| Title | Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-08-19T06:00:20.316Z
Reserved: 2026-08-05T12:42:03.011Z
Link: CVE-2026-18937
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-19T06:17:38.847
Modified: 2026-08-19T06:17:38.847
Link: CVE-2026-18937
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.