# Broken Link Checker <= 2.4.14.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Truncation and .htaccess Overwrite via Custom Log File Path

- **ID:** WPSEC-2026-0921
- **Plugin:** Broken Link Checker (`broken-link-checker`), https://wordpress.org/plugins/broken-link-checker/
- **Affected versions:** all versions before 2.4.15
- **Fixed in:** 2.4.15 (Update to 2.4.15 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/broken-link-checker
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0921/

## Description

The Broken Link Checker plugin for WordPress is vulnerable to Path Traversal via the custom log file path setting in all versions up to, and including, 2.4.14.1 due to the submitted path being checked only for its file extension before it is used to create directories, to write a 'Deny from all' .htaccess file next to a new log file, and for logging and truncation by the clear-log cron. This makes it possible for authenticated attackers with administrator-level access to overwrite .htaccess files in any web-server-writable directory and to truncate or append to arbitrary writable files with an allowed extension. This mainly affects multisite installations, where a subsite administrator, who otherwise has no file access, can overwrite the network's root .htaccess (taking every site offline) and damage other sites' files.

## References

- https://wpsec.com/vuln/WPSEC-2026-0921/
- https://plugins.svn.wordpress.org/broken-link-checker/tags/2.4.15/
- https://wordpress.org/plugins/broken-link-checker/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0921/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.