Broken Link Checker CVE-2026-18937

Exploitation requires three concrete conditions drawn from the description: (1) the vulnerable Broken Link Checker plugin at a version before 2.4.12 must be installed and active; (2) the WordPress site must be configured with PLAIN permalinks (not the default pretty/rewrite permalinks) - this is what lets the unfiltered query variables reach the plugin; and (3) a CLASSIC, non-block theme must be active for the global-variable overwrite to escalate into arbitrary PHP code execution. No authentication is required (CVSS PR:N, unauthenticated) and no user interaction is needed (UI:N). Limiting factors: both plain permalinks and classic themes are non-default on many current WordPress installations, and the AC:H rating reflects that these specific configuration prerequisites must all be met; sites on pretty permalinks or block themes are not exploitable to RCE through this vector.

The signals are mixed and should be weighed together. CVSS is 9.0 (Critical) with an unauthenticated network vector (AV:N/PR:N/UI:N) and a scope change (S:C) reflecting the jump from plugin context to full server code execution - that drives the high score. However AC:H explicitly encodes meaningful preconditions: the site must use plain permalinks AND run a classic (non-block) theme, both of which are non-default for many modern WordPress installs (pretty permalinks and block themes like Twenty Twenty-Three/Four are common defaults). EPSS is low at 0.22% (13th percentile), and the CVE is NOT on CISA KEV, so there is no confirmed active exploitation. No public POC is referenced. SSVC-style reading: exploitation = none observed, automatable = partly (unauthenticated and network-reachable, but gated by configuration), technical impact = total (RCE). Net: this is a genuinely serious flaw worth prompt patching because it is unauthenticated RCE, but the AC:H configuration gates and low EPSS mean it is currently a patch-soon priority rather than an emergency drop-everything issue for sites not running the vulnerable configuration. The main uncertainty is prevalence of the required plain-permalink + classic-theme combination in the wild.

An unauthenticated attacker identifies a WordPress site running Broken Link Checker (< 2.4.12) with plain permalinks and a classic theme, then sends a crafted HTTP request whose query variables overwrite PHP global state used by the plugin. By injecting attacker-controlled data into a dynamic code path exposed through the active classic theme, the attacker achieves arbitrary PHP execution on the server. No public POC is referenced at time of analysis, and the AC:H rating reflects the setup and configuration knowledge the attacker must satisfy.