Vulnerabilities / Broken Link Checker / WPSEC-2026-0923
Broken Link Checker <= 2.4.14.1 - Unauthenticated Authentication Bypass to Scan Report Recipient Removal
Medium 5.3
CWE-287Fixed in 2.4.15
- ID
- WPSEC-2026-0923
- Plugin
- Broken Link Checker (broken-link-checker)
- Affected
- all versions before 2.4.15
- Remediation
- Update to 2.4.15 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- Broken Link Checker on WPSec AttackSurface
- Fix released
- Published
Description
The Broken Link Checker plugin for WordPress is vulnerable to Authentication Bypass via the recipient activation webhook in all versions up to, and including, 2.4.14.1, due to the get_recipient_by_key() function matching registered-user recipients on the MD5 hash of their email address alone, without checking the stored random recipient key. This makes it possible for unauthenticated attackers who know a registered recipient's email address to forge a cancellation token and remove that user from the scan report recipients.
References
- https://wpsec.com/vuln/WPSEC-2026-0923/
- https://plugins.svn.wordpress.org/broken-link-checker/tags/2.4.15/
- https://wordpress.org/plugins/broken-link-checker/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS