Unauthorized Post Modification Vulnerability in AIOSEO's Broken Link Checker for WordPress

CVE-2025-11734

What is CVE-2025-11734?

The Broken Link Checker plugin by AIOSEO for WordPress exhibits a security flaw that allows authenticated users with contributor-level access to modify posts without proper authorization checks. This vulnerability arises from the plugin registering a REST API endpoint that only verifies a broad capability granted to contributor users, failing to validate their permission for specific posts. As a result, an attacker with sufficient access can delete arbitrary posts using the provided API endpoint, creating a significant risk for content integrity.

References