{
 "id": "WPSEC-2026-0920",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0920/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0920/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0920/index.md",
 "title": "Broken Link Checker <= 2.4.14.1 - Authenticated (Editor+) Missing Authorization to Broken Link Edit, Unlink and Deredirect",
 "description": "The Broken Link Checker plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.14.1 due to the link edit, unlink and deredirect AJAX actions and their bulk equivalents only checking the edit_others_posts capability instead of verifying edit permissions on each post, comment or other container holding the link. This makes it possible for authenticated attackers with editor-level access, or users granted that capability, to rewrite or remove links in content they are not permitted to edit.",
 "plugin": {
  "slug": "broken-link-checker",
  "name": "Broken Link Checker",
  "full_name": "Broken Link Checker",
  "wordpress_org": "https://wordpress.org/plugins/broken-link-checker/",
  "advisories_url": "https://wpsec.com/vuln/plugin/broken-link-checker/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/broken-link-checker"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.15",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.15"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.15",
 "remediation": "Update to 2.4.15 or later.",
 "fix_released": "2026-10-12T07:25:12+00:00",
 "published": "2026-10-14T13:49:25+00:00",
 "updated": "2026-10-14T13:19:42.586398+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0920/",
  "https://plugins.svn.wordpress.org/broken-link-checker/tags/2.4.15/",
  "https://wordpress.org/plugins/broken-link-checker/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/broken-link-checker",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-14"
 }
}