CVE-2026-102389
Received Received - Intake

Code Injection in WPMU DEV Broken Link Checker

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Patchstack

Description
Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-102389
EUVD
EUVD-2026-102050

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WPMU DEV Broken Link Checker 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Code Injection vulnerability in the WPMU DEV Broken Link Checker plugin. It allows attackers to inject unwanted content like ads, scams, or malware links into web pages. The issue affects versions up to 2.4.14.1 and requires a privileged user to trigger the exploit by clicking a malicious link or submitting a form.

Detection Guidance

Check if the Broken Link Checker plugin version is 2.4.14.1 or earlier. Use WordPress admin panel to inspect plugin versions or run SQL queries on the database to verify the installed version.

Impact Analysis

Attackers could inject malicious content into your website, potentially spreading malware, scams, or unwanted ads. This could damage your site's reputation, harm visitors, and lead to security breaches. The vulnerability may also be exploited in mass campaigns targeting many websites.

Compliance Impact

This vulnerability could lead to unauthorized content changes, potentially violating data integrity and security requirements under GDPR and HIPAA. If exploited, it may result in non-compliance due to compromised user data or website integrity.

Mitigation Strategies

Update the Broken Link Checker plugin to version 2.4.15 immediately. Apply Patchstack's mitigation rule if available to block attacks until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102389. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart