CVE-2026-18937 — Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection

CVE-2026-18937

Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection PUBLISHED

Description (CNA)

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.

Affected (CNA)

Vendor / product	Versions
Unknown / Broken Link Checker	affected 0 before 2.4.12

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a23b76eb-107d-4e02-8eae-c3c5fa5b003d/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.