Arbitrary Code Execution Vulnerability in Broken Link Checker Plugin by WordPress
CVE-2026-18937
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 19 August 2026
Badges
What is CVE-2026-18937?
The Broken Link Checker plugin for WordPress, prior to version 2.4.12, is susceptible to a serious security vulnerability. This issue arises from the lack of restrictions on the query variables that the plugin accepts from user input on sites employing plain permalinks. As a result, unauthenticated users may exploit the vulnerability to modify arbitrary PHP global variables, ultimately leading to the execution of arbitrary code on the server. This threat is particularly significant when a classic (non-block) execution method is active, making it crucial for WordPress site administrators to update their plugins promptly to mitigate potential risks.
Affected Version(s)
Broken Link Checker 0 < 2.4.12
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.