Broken Link Checker <= 2.4.14.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Truncation and .htaccess Overwrite via Custom Log File Path
- ID
- WPSEC-2026-0921
- Plugin
- Broken Link Checker (broken-link-checker)
- Affected
- all versions before 2.4.15
- Remediation
- Update to 2.4.15 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- Broken Link Checker on WPSec AttackSurface
- Fix released
- Published
Description
The Broken Link Checker plugin for WordPress is vulnerable to Path Traversal via the custom log file path setting in all versions up to, and including, 2.4.14.1 due to the submitted path being checked only for its file extension before it is used to create directories, to write a 'Deny from all' .htaccess file next to a new log file, and for logging and truncation by the clear-log cron. This makes it possible for authenticated attackers with administrator-level access to overwrite .htaccess files in any web-server-writable directory and to truncate or append to arbitrary writable files with an allowed extension. This mainly affects multisite installations, where a subsite administrator, who otherwise has no file access, can overwrite the network's root .htaccess (taking every site offline) and damage other sites' files.
References
- https://wpsec.com/vuln/WPSEC-2026-0921/
- https://plugins.svn.wordpress.org/broken-link-checker/tags/2.4.15/
- https://wordpress.org/plugins/broken-link-checker/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS