Description

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-19T06:17:38.847Z",
  "pubdate": "2026-08-19T06:17:38.847Z",
  "executiveSummary": "The Broken Link Checker WordPress plugin prior to version 2.4.12 suffers from an input validation vulnerability involving the improper limitation of accepted query variables on sites using plain permalinks.\nThis vulnerability allows unauthenticated remote attackers to overwrite arbitrary PHP global variables.\nWhen a classic non-block theme is active, this global variable manipulation can be leveraged to achieve arbitrary remote code execution on the underlying server.\nThe flaw poses a critical risk to confidentiality, integrity, and availability, effectively granting complete system compromise to unauthenticated threat actors who interact with vulnerable installations.\nExploitation requires no prior authentication or special privileges, relying solely on network accessibility to the WordPress instance configured with plain permalinks and a classic editor or theme setup.",
  "technicalDetails": "The root cause of the vulnerability lies in the Broken Link Checker plugin's failure to adequately sanitize, whitelist, or restrict the query variables it processes from user-supplied HTTP input specifically when plain permalinks are enabled.\nIn PHP applications, improper handling of user input that maps directly to global scope variables can lead to register_globals-style vulnerabilities or direct modification of superglobals and internal application state.\nBy submitting specially crafted HTTP requests containing malicious query parameters, an unauthenticated attacker can manipulate PHP global variables during the execution lifecycle of the plugin.\nThe attack flow begins with the attacker identifying a target WordPress site running the vulnerable Broken Link Checker plugin version below 2.4.12 with plain permalinks active.\nThe attacker crafts an HTTP request injecting parameters designed to overwrite specific PHP globals utilized by the application framework or active themes.\nWhen the site processes the request with a classic non-block theme active, the manipulation of these global variables alters execution paths, enabling the injection and subsequent evaluation or execution of arbitrary PHP code provided in the payload.\nThe network exposure is public-facing via HTTP/HTTPS, requiring no privileges or authentication.\nPost-exploitation impact includes full remote code execution, allowing the attacker to read or write sensitive files, establish persistence, pivot to internal network resources, or execute arbitrary system commands with the privileges of the web server user."
}