WordPress Broken Link Checker < 2.4.12 - Remote Code Execution
CVE-2026-18937
Verified
Description
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables on the server when a classic (non-block) theme is active.
Severity
Critical
CVSS Score
9
Exploit Probability
2%
Affected Product
broken-link-checker
Published Date
October 22, 2026
Template Author
anirbala98
CVE-2026-18937.yaml
9.0Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2026-18937
CWE ID:
cwe-94
Remediation Steps
Upgrade to version 2.4.12 or later.