SQL Injection Vulnerability in AIOSEO's Broken Link Checker Plugin
CVE-2025-1264
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 6 April 2025
What is CVE-2025-1264?
The Broken Link Checker plugin by AIOSEO, designed to monitor and fix internal and external links, is susceptible to SQL Injection due to inadequate input validation on the 'orderBy' parameter. This vulnerability allows authenticated users with Contributor-level access and higher to manipulate existing SQL queries, potentially leading to unauthorized access and retrieval of sensitive database information. Correcting this flaw requires proper sanitization of user inputs and restructuring of database queries to enhance security.
Affected Version(s)
Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links * <= 1.2.3