Broken Link Checker <= 2.4.14.1 - Authenticated (Contributor+) PHP Object Injection via SiteOrigin panels_data Post Meta
- ID
- WPSEC-2026-0918
- Plugin
- Broken Link Checker (broken-link-checker)
- Affected
- all versions before 2.4.15
- Remediation
- Update to 2.4.15 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- Broken Link Checker on WPSec AttackSurface
- Fix released
- Published
Description
The Broken Link Checker plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.14.1 via the SiteOrigin Page Builder panels_data post meta, due to the value returned by get_post_meta() being passed to maybe_unserialize() a second time when a Cloud broken link action (edit or unlink) processes the post. This makes it possible for authenticated attackers with contributor-level access and above to store a serialized PHP object in the panels_data custom field of their own post, which is instantiated when a site administrator runs a Cloud link action on a link in that post while SiteOrigin Page Builder is active. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-0918/
- https://plugins.svn.wordpress.org/broken-link-checker/tags/2.4.15/
- https://wordpress.org/plugins/broken-link-checker/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS