What is the CVSS score of CVE-2026-39466?

CVE-2026-39466 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-39466?

The WPMU DEV Broken Link Checker plugin (versions ≤2.4.7) contains a blind SQL injection vulnerability affecting authenticated high-privilege WordPress users, enabling unauthorized database…

How to fix or mitigate CVE-2026-39466?

Within 24 hours: Audit active installations of Broken Link Checker plugin and document all administrator accounts with access; disable the plugin if not operationally critical. Within 7 days: Restrict Broken Link Checker access to essential administrators only and implement Web Application Firewall (WAF) rules to detect SQL injection patterns in admin requests. Within 30 days: Update to patched version immediately upon vendor release; if no patch is available within 30 days, evaluate permanent plugin replacement with an alternative link monitoring solution.

WordPress CVE-2026-39466

EUVD-2026-20137 HIGH

SQL Injection (CWE-89)

2026-04-08 Patchstack

GHSA-vvmg-mccx-3wpj

SQLi WordPress

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:25 vuln.today

CVSS changed

Apr 13, 2026 - 17:22 NVD

7.6 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20137

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Broken Link Checker broken-link-checker allows Blind SQL Injection.This issue affects Broken Link Checker: from n/a through <= 2.4.7.

AnalysisAI

Blind SQL injection in WPMU DEV Broken Link Checker WordPress plugin versions ≤2.4.7 allows authenticated high-privilege users to extract database contents and potentially cause limited availability impact. CVSS 7.6 with scope change indicates potential container escape from plugin context. EPSS score of 0.02% (6th percentile) suggests low immediate exploitation likelihood. No public exploit code or CISA KEV listing identified at time of analysis. Patchstack discovery indicates vulnerability likely responsibly disclosed through bug bounty channel.

Technical ContextAI

This vulnerability exists in the Broken Link Checker plugin (CPE: cpe:2.3:a:wpmu_dev_-_your_all-in-one_wordpress_platform:broken_link_checker) developed by WPMU DEV for WordPress. The issue is classified as CWE-89 (SQL Injection), specifically manifesting as blind SQL injection where attacker-controlled input is insufficiently sanitized before incorporation into SQL queries. Blind SQL injection differs from traditional SQLi in that query results are not directly returned to the attacker; instead, exploitation relies on inferential techniques such as boolean-based or time-based attacks to extract data one bit at a time. The WordPress plugin architecture uses MySQL/MariaDB databases for storing site data, and inadequate input validation in plugin database queries can expose the entire WordPress database to unauthorized access. The 'S:C' (Scope Changed) CVSS metric indicates the vulnerability's impact extends beyond the plugin's security context, potentially affecting the broader WordPress installation or database.

RemediationAI

Immediately upgrade Broken Link Checker plugin to a version newer than 2.4.7 when released by WPMU DEV. Monitor the WordPress.org plugin repository and WPMU DEV's official channels for security updates addressing CVE-2026-39466. As interim mitigation, organizations can restrict WordPress administrator role assignment to only fully trusted personnel, implement principle of least privilege by using Editor or lower roles where possible, enable WordPress security audit logging to detect suspicious database queries, deploy web application firewall rules to inspect SQL injection patterns in plugin requests, or temporarily deactivate the Broken Link Checker plugin if not business-critical until patched version is available. Review the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/broken-link-checker/vulnerability/wordpress-broken-link-checker-plugin-2-4-7-sql-injection-vulnerability for additional vendor-specific remediation guidance. Consult NVD listing at https://nvd.nist.gov/vuln/detail/CVE-2026-39466 for updates on patch availability.