Deserialization Vulnerability in Broken Link Checker Plugin for WordPress

CVE-2022-2438

Summary

The Broken Link Checker plugin for WordPress has a vulnerability that allows authenticated attackers with administrative privileges to exploit the '$log_file' parameter, leading to the deserialization of untrusted data. This risk enables the potential execution of arbitrary PHP objects through a PHAR wrapper, contingent upon the attacker uploading a malicious file containing a serialized payload. Successful exploitation could lead to a variety of harmful actions if the appropriate conditions are in place.

References