Broken Link Checker EUVD-2026-102635

Exploitation requires that the attacker submit a comment whose href or src attribute contains a WordPress shortcode payload, AND that this comment be approved through the site's normal comment moderation workflow by a moderator; only after approval does the plugin's link parser (html_link.php / image.php) pass the value to do_shortcode via a scheduled WP-Cron scan, executing the shortcode with no further attacker interaction. The decisive limiting factor is the required moderator approval - on sites with manual comment moderation or strict spam filtering, the malicious comment may never be approved, blocking the chain entirely. Impact is further bounded by which shortcodes are registered on the target site. No authentication is needed to submit the comment itself.

The CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N) frames this as a network-reachable, unauthenticated, low-complexity issue, but that vector understates the real precondition: the description makes clear that exploitation only succeeds after a submitted comment containing the shortcode payload is approved through the site's normal moderation workflow. That approval is a human gate performed by a privileged moderator, which in practice behaves like required user interaction and sharply lowers real-world likelihood versus a true pre-auth RCE. No EPSS score was supplied and the input contains no KEV or POC signal, so exploitation status is 'no public exploit identified at time of analysis.' There is a signal conflict worth flagging: the CVSS vector encodes UI:N, yet the description explicitly requires a moderator to approve the malicious comment - the published vector appears to not credit that moderation step as user interaction, so defenders should treat the effective risk as lower than UI:N implies. Impact is also bounded (C:L/I:L/A:N) because this is arbitrary WordPress shortcode execution, not native code execution; actual severity depends on which shortcodes are registered on the target. Net: a genuine but conditional, low-privilege injection flaw in widely-deployed software - worth patching promptly, but not an internet-wide mass-exploitation emergency absent a POC.

An unauthenticated attacker posts a blog comment in which the href or src attribute carries a WordPress shortcode payload. A site moderator later approves the comment as part of normal moderation; the Broken Link Checker plugin then scans the stored link and, via WP-Cron, passes the unvalidated attribute value to do_shortcode, executing the attacker's shortcode automatically with no further attacker action. No public exploit code was identified in the provided data.