# Broken Link Checker <= 2.4.14.1 - Authenticated (Editor+) Missing Authorization to Broken Link Edit, Unlink and Deredirect

- **ID:** WPSEC-2026-0920
- **Plugin:** Broken Link Checker (`broken-link-checker`), https://wordpress.org/plugins/broken-link-checker/
- **Affected versions:** all versions before 2.4.15
- **Fixed in:** 2.4.15 (Update to 2.4.15 or later.)
- **Severity:** Low 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/broken-link-checker
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0920/

## Description

The Broken Link Checker plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.14.1 due to the link edit, unlink and deredirect AJAX actions and their bulk equivalents only checking the edit_others_posts capability instead of verifying edit permissions on each post, comment or other container holding the link. This makes it possible for authenticated attackers with editor-level access, or users granted that capability, to rewrite or remove links in content they are not permitted to edit.

## References

- https://wpsec.com/vuln/WPSEC-2026-0920/
- https://plugins.svn.wordpress.org/broken-link-checker/tags/2.4.15/
- https://wordpress.org/plugins/broken-link-checker/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0920/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.