Vulnerabilities / Broken Link Checker / WPSEC-2026-0920
Broken Link Checker <= 2.4.14.1 - Authenticated (Editor+) Missing Authorization to Broken Link Edit, Unlink and Deredirect
Low 2.7
CWE-863Fixed in 2.4.15
- ID
- WPSEC-2026-0920
- Plugin
- Broken Link Checker (broken-link-checker)
- Affected
- all versions before 2.4.15
- Remediation
- Update to 2.4.15 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- Broken Link Checker on WPSec AttackSurface
- Fix released
- Published
Description
The Broken Link Checker plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.14.1 due to the link edit, unlink and deredirect AJAX actions and their bulk equivalents only checking the edit_others_posts capability instead of verifying edit permissions on each post, comment or other container holding the link. This makes it possible for authenticated attackers with editor-level access, or users granted that capability, to rewrite or remove links in content they are not permitted to edit.
References
- https://wpsec.com/vuln/WPSEC-2026-0920/
- https://plugins.svn.wordpress.org/broken-link-checker/tags/2.4.15/
- https://wordpress.org/plugins/broken-link-checker/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS