CVE-2025-11734: Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links <= 1.2.5 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Trashing
The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization in all versions up to, and including, 1.2.5. This is due to the plugin registering a REST API endpoint that only checks for a broad capability (aioseoblcbrokenlinkspage) that is granted to contributor level users, without verifying the user's permission to perform actions on the specific post being targeted. This makes it possible for authenticated attackers, with contributor level access and above, to trash arbitrary posts via the DELETE /wp-json/aioseoBrokenLinkChecker/v1/post endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11734?
CVE-2025-11734 is categorized as a high severity vulnerability due to unauthorized post modification risks.
How do I fix CVE-2025-11734?
To fix CVE-2025-11734, update the AIOSEO Broken Link Checker plugin to version 1.2.6 or later.
What are the risks associated with CVE-2025-11734?
The risks of CVE-2025-11734 include unauthorized users being able to modify posts without proper permissions.
Which versions of AIOSEO Broken Link Checker are affected by CVE-2025-11734?
CVE-2025-11734 affects all versions of AIOSEO Broken Link Checker up to and including version 1.2.5.
Is there a workaround for CVE-2025-11734 until I can update?
As a temporary workaround for CVE-2025-11734, consider disabling the AIOSEO Broken Link Checker plugin until an update can be applied.