CVE-2026-18937: critical vulnerability in Broken Link Checker
Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection
Published
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9epss 0.5%
from disclosure to weapon31 days
Published on NVDAug 19
1st PoC+31d
exploitation probability
0.5%top 55% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Unknown · Broken Link Checkerpublic PoCs found — 2
githubgithub.com/abraxas/CVE-2026-18937★ 0cve_referencewpscan.com/vulnerability/a23b76eb-107d-4e02-8eae-c3c5fa5b003d/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Broken Link Checker
In the same product, most dangerous first.