{
 "id": "WPSEC-2026-0918",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0918/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0918/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0918/index.md",
 "title": "Broken Link Checker <= 2.4.14.1 - Authenticated (Contributor+) PHP Object Injection via SiteOrigin panels_data Post Meta",
 "description": "The Broken Link Checker plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.14.1 via the SiteOrigin Page Builder panels_data post meta, due to the value returned by get_post_meta() being passed to maybe_unserialize() a second time when a Cloud broken link action (edit or unlink) processes the post. This makes it possible for authenticated attackers with contributor-level access and above to store a serialized PHP object in the panels_data custom field of their own post, which is instantiated when a site administrator runs a Cloud link action on a link in that post while SiteOrigin Page Builder is active. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
 "plugin": {
  "slug": "broken-link-checker",
  "name": "Broken Link Checker",
  "full_name": "Broken Link Checker",
  "wordpress_org": "https://wordpress.org/plugins/broken-link-checker/",
  "advisories_url": "https://wpsec.com/vuln/plugin/broken-link-checker/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/broken-link-checker"
 },
 "type": "OBJECT INJECTION",
 "cwe": [
  "CWE-502"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.15",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.15"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.15",
 "remediation": "Update to 2.4.15 or later.",
 "fix_released": "2026-10-12T07:25:12+00:00",
 "published": "2026-10-14T13:49:25+00:00",
 "updated": "2026-10-14T13:19:42.586398+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0918/",
  "https://plugins.svn.wordpress.org/broken-link-checker/tags/2.4.15/",
  "https://wordpress.org/plugins/broken-link-checker/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/broken-link-checker",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-14"
 }
}