Broken Link Notifier EUVD-2026-89627

Exploitable when the Broken Link Notifier plugin (versions 1.3.1 up to but not including 2.0.0.1) is installed and active on WordPress, and its link-checking functionality can be reached/triggered by an unauthenticated actor. The specific weakness is that the plugin's internal-address filter validates the initial URL but does NOT re-validate the destination after an HTTP redirect, so an attacker-controlled URL that redirects to an internal address bypasses the SSRF protection. Limiting factors: impact is confined to the server issuing requests to internal services with only low confidentiality disclosure (C:L), no integrity or availability impact, and realistic value depends on the presence of sensitive internal/metadata endpoints reachable from the WordPress host; no active exploitation or public exploit code is known.

This is a moderate, network-reachable SSRF (CWE-918) with a CVSS 3.1 base score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N), meaning unauthenticated remote exploitation with low complexity and a scope change into internal services, but only low confidentiality impact and no integrity or availability impact. All signals converge on 'real but not urgent': CISA's SSVC framework rates Exploitation as 'none' (no observed exploitation), Automatable as 'no', and Technical Impact as 'partial', consistent with the low CVSS impact metrics. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not a confirmed active-exploitation priority. The scope-change flag (S:C) and unauthenticated vector make it worth patching promptly on exposed WordPress sites, but the constrained impact (server can be coerced into sending requests to internal hosts, yielding limited disclosure) keeps it well below critical. No key data is missing or conflicting: the vendor/WPScan advisory, CVSS vector, and SSVC all agree the primary risk is internal service reconnaissance/probing rather than direct compromise.

An unauthenticated attacker submits or references a link that the plugin's link-checker fetches; the initial URL passes the internal-address filter but issues an HTTP redirect that the plugin follows without re-validating the destination, so the WordPress server is coerced into requesting an internal service (e.g., cloud metadata endpoints, internal admin panels, or other RFC1918 hosts). No POC is publicly identified at time of analysis, and CISA SSVC rates the flaw as not currently exploited and not automatable.