Broken Link Checker CVE-2026-75528

Exploitation requires all of the following specific conditions to be met: (1) Broken Link Checker plugin version 2.4.13 or earlier must be installed and active on the WordPress site; (2) WordPress comment submission must be enabled on at least one post so the attacker can inject a malicious comment author URL without authentication; (3) an administrator must explicitly invoke the dismiss-and-recheck workflow on the attacker-submitted link entry within the plugin's admin interface - this is a deliberate action, not passive page load; (4) the attacker must operate or control an HTTP server reachable by the WordPress server at the time of the recheck, capable of issuing an HTTP redirect response to a URL containing the HTML/JavaScript payload. The mandatory admin interaction (UI:R) is the primary limiting factor preventing automated mass exploitation. Comment submission may itself be restricted on some WordPress sites (e.g., comments disabled, registration required), which would block the initial injection vector entirely.

The submitted CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) contains a material discrepancy: UI:N (no user interaction required) conflicts directly with the description, which explicitly states exploitation requires an administrator to perform the dismiss-and-recheck workflow. In practice UI:R applies, which would reduce the base score from 7.2 to approximately 6.1, meaningfully lowering prioritization relative to fully automated attacks. The scope-change assignment (S:C) is appropriate because XSS payloads executing in the admin browser context can affect other users and exfiltrate session tokens beyond the plugin itself. No EPSS score was provided in the input data; no active exploitation has been confirmed (CISA KEV absent) and no public exploit code has been identified, both of which reduce urgency compared to weaponized network-reachable vulnerabilities. The multi-step exploitation path - submit comment, wait for admin-triggered crawl, serve redirect payload - limits opportunistic mass exploitation but does not preclude targeted attacks against specific WordPress sites. Even a mid-sized municipal IT team in koszalin managing a public-facing WordPress deployment should treat this as a prompt-patch priority rather than a deferred maintenance item, given that the admin interaction requirement is a plausible event during routine link-log review. The stored nature of the payload means a single successful delivery persists until the log entry is cleared.

An attacker posts a WordPress comment using a URL pointing to an HTTP server under their control as the comment author URL. When a site administrator encounters this entry in the Broken Link Checker link log and performs the standard dismiss-and-recheck action, the plugin's HTTP crawler fetches the URL and the attacker's server responds with an HTTP redirect to a destination URL containing an embedded JavaScript payload; the plugin stores this redirect destination verbatim in the link log without sanitization. The next time any administrator opens the link log page, the stored payload executes in their browser session, enabling session token theft, credential harvesting, or admin-level actions on the WordPress site.