External risk intelligence

Broken Link Checker WordPress Plugin Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-18937

The vulnerability exists in a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications, making the plugin's functionality accessible to unauthenticated users over the internet.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress plugin that could allow unauthenticated users to execute arbitrary code on affected servers. This issue arises from the plugin's failure to properly validate user input, potentially leading to a compromise of the underlying web application. The main concern is confirming the relevance and exposure of this plugin within our environments.

Unauthenticated code execution on WordPress sites.
Impacts public-facing web applications.
Confirm if this plugin is in use.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to a WordPress site with plain permalinks enabled. The vulnerable plugin would then process these requests, allowing the attacker to manipulate PHP global variables. If the site also uses a classic theme, this manipulation could lead to arbitrary code execution on the server.

No authentication required for access.
Exploits query variable processing.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When WordPress sites utilize plain permalinks and a classic editor theme is active, unauthenticated users could potentially overwrite PHP global variables. This could lead to the execution of arbitrary code on the server, impacting the integrity and availability of the affected website.

Server-side code execution.
Unsanitized query variables.
Website compromise and data alteration.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Broken Link Checker WordPress plugin impacts sites using plain permalinks, potentially allowing unauthenticated code execution. Infrastructure and platform teams managing WordPress deployments should prioritize identifying all instances of this plugin. The first practical step involves locating affected sites, assessing their exposure and criticality, and then coordinating remediation with application owners and potentially the plugin vendor, using maintenance windows or temporary controls as appropriate.

WordPress platform and infrastructure teams own remediation.
Verify plugin presence and plain permalink configuration.
Plan coordinated updates or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Broken Link Checker WordPress plugin?

Broken Link Checker is a software component designed for WordPress sites to monitor and identify broken hyperlinks or missing images. By scanning content, it helps maintain site navigation and user experience. It runs within the WordPress environment, executing on the server whenever requested to process links or site metadata.

What does CVE-2026-18937 mean for security?

This vulnerability is classified as CWE-94, which refers to improper control of generation of code. In simple terms, the plugin fails to filter incoming data properly, allowing an attacker to inject and run their own instructions on the server. This can lead to a full compromise of the website's functionality and data.

How can an attacker trigger this vulnerability?

An attacker needs to send specific, malicious requests to a site using the plugin. Crucially, the site must be configured to use plain permalinks. If your site uses pretty permalinks or does not utilize a classic theme, these specific conditions for code execution are not met, though the underlying input handling issue remains.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal indicates that because this plugin is part of WordPress, which is typically deployed as a public-facing web application, it is highly likely to be accessible to unauthenticated users over the internet. You should consider any installation of this plugin on an internet-connected server to be a potential point of entry.

Do I need to update Broken Link Checker immediately?

Yes. The first step is to confirm if your site uses the affected versions of this plugin and is running with plain permalinks and a classic theme. If so, prioritize identifying these instances and coordinate with your team to apply the vendor's update or implement temporary controls to prevent unauthorized access until you can patch.

References

wpscan.com/vulnerability/a23b76eb-107d-4e02-8eae-c3c5fa5b003d/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.