Unauthorized Post Modification Vulnerability in AIOSEO's Broken Link Checker for WordPress

CVE-2025-11734

What is CVE-2025-11734?

The Broken Link Checker plugin by AIOSEO for WordPress exhibits a security flaw that allows authenticated users with contributor-level access to modify posts without proper authorization checks. This vulnerability arises from the plugin registering a REST API endpoint that only verifies a broad capability granted to contributor users, failing to validate their permission for specific posts. As a result, an attacker with sufficient access can delete arbitrary posts using the provided API endpoint, creating a significant risk for content integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References