Broken Link Checker EUVD-2026-20137

Exploitation requires the attacker to possess WordPress high-privilege account credentials (Administrator or potentially Editor role with plugin access permissions). The Broken Link Checker plugin must be installed, activated, and accessible to the authenticated user role. Specific vulnerable functionality exists within database query handlers that accept user input from plugin interface fields (likely search, filter, or configuration parameters based on typical plugin architecture). The PR:H CVSS metric confirms that standard low-privilege WordPress Subscriber or Contributor accounts cannot exploit this vulnerability - only accounts with administrative database query privileges through the plugin's intended functionality are at risk.

Real-world exploitation risk is moderate despite the 7.6 CVSS score. Critical mitigating factors include the PR:H (High Privilege Required) authentication requirement, meaning only WordPress administrators or editors can exploit this vulnerability - significantly reducing the attack surface compared to unauthenticated SQLi. The EPSS score of 0.02% (6th percentile) indicates security researchers assess exploitation probability as very low in the next 30 days. No CISA KEV listing confirms this is not actively exploited in the wild. No publicly available POC exists per available data. The SSVC decision framework would classify this as: Exploitation Status (none public), Automatable (no - requires high-privilege authentication), Technical Impact (total for confidentiality given database access). Primary concern is insider threat scenarios or compromised administrator accounts being leveraged for data exfiltration. The Scope Change elevates risk slightly as successful exploitation could pivot from plugin context to full WordPress database access. Organizations should prioritize patching based on whether they grant WordPress administrative access to untrusted or semi-trusted users, and whether the plugin is actively installed and enabled.

An attacker who has compromised WordPress administrator credentials (either through phishing, credential stuffing, or insider access) authenticates to the WordPress admin panel and navigates to the Broken Link Checker plugin interface. The attacker crafts malicious input containing SQL injection payloads in plugin parameters that interact with database queries, such as link URL filters or search fields. Using blind SQL injection techniques like time-based delays (SLEEP() functions) or boolean-based inference, the attacker systematically extracts sensitive data from the WordPress database including user credentials, customer information, or site configuration details, one character at a time over multiple requests.