Broken Link Checker CVE-2026-102389

Exploitation targets the Broken Link Checker WordPress plugin at versions up to and including 2.4.14.1 and requires the plugin to be installed and active so that its link-checking/parsing routine processes attacker-supplied data. Per the CVSS vector it is network-reachable and needs no authentication (PR:N) but does require user interaction (UI:R) - a victim must trigger the vulnerable action (e.g., visiting or processing attacker-controlled content), which meaningfully limits mass/automated exploitation. The mandatory user interaction and the plugin-active prerequisite are the principal limiting factors; the stated impact is confined to confidentiality (C:H) with no integrity or availability effect.

Signals are mixed and should be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5 Medium) describes a network-reachable, low-complexity, unauthenticated issue that requires user interaction and yields only a confidentiality impact (C:H) with no integrity or availability effect. This is internally inconsistent with the CWE-94 classification and the 'RCE'/'Code Injection' tags: genuine code injection would normally carry a high integrity impact (I:H), yet the authoritative Patchstack reference titles this a 'content injection vulnerability,' suggesting the real-world effect is closer to injected content/limited code execution than full remote code execution - verify the actual impact with the vendor/Patchstack advisory. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation likelihood cannot be quantified from the input; exploitation status is 'no public exploit identified at time of analysis.' Net assessment: this is a moderate-priority patch item for WordPress operators rather than an emergency - the medium CVSS, the required user interaction (UI:R), and the absence of any exploitation evidence all argue against treating it as actively dangerous, but the large install base of the affected plugin means it should not be ignored. The C:H/I:N 'RCE' labeling conflict is the single most important thing to resolve before prioritization.

An unauthenticated remote attacker crafts malicious input (for example a booby-trapped link or page that the plugin's link-checking routine processes) and lures a WordPress site user or administrator into an action that triggers the vulnerable code path (UI:R). When the plugin parses the attacker-controlled data it injects attacker-chosen code/content, which per the CVSS vector leads to disclosure of sensitive information (C:H). No public exploit code was identified in the provided intelligence.