CVE-2026-18937

Deferred Deferred - Pending Action

Broken Link Checker WordPress Plugin PHP Object Injection

Publication date: 2026-08-19

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-18937

EUVD

EUVD-2026-62285

Affected Vendors & Products

Vendor	Product	Version / Range
wpbeaverbuilder	broken_link_checker	to 2.4.12 (exc)
broken_link_checker	broken_link_checker	to 2.4.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Broken Link Checker WordPress plugin before version 2.4.12. It allows unauthenticated users to overwrite arbitrary PHP global variables by manipulating query variables on sites using plain permalinks. This can lead to arbitrary code execution on the server when a classic theme is active.

Detection Guidance

Check if the Broken Link Checker plugin version is below 2.4.12. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI to verify the installed version.

Impact Analysis

An attacker could exploit this flaw to execute malicious code on your server, potentially taking control of your WordPress site. Since plain permalinks are common in single-site installations, many users are at risk. The vulnerability is critical and requires immediate attention.

Compliance Impact

This vulnerability allows unauthenticated attackers to execute arbitrary code on the server, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR and HIPAA by exposing personal or health information.

Mitigation Strategies

Update the Broken Link Checker plugin to version 2.4.12 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied.

Hi! I’m here to help you understand CVE-2026-18937. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70