CVE-2026-18937: Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated code execution?
Affected sites use a Broken Link Checker version before 2.4.12, have WordPress configured with plain permalinks, and have an active classic (non-block) theme. The issue can be exploited without authentication under those conditions.
What attacker access is required?
No account or prior authentication is required. An attacker can supply query-variable input that is not properly restricted and overwrite PHP global variables.
Are sites using block themes or non-plain permalinks affected in the same way?
The described code-execution condition specifically requires plain permalinks and an active classic, non-block theme. The provided information does not state that the same unauthenticated RCE applies when those conditions are absent.