CVE-2026-102389— WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability
Quick assessment
Affected
WPMU DEV Broken Link Checker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 WPMU DEV 的 Broken Link Checker（broken-link-checker）插件中存在一个“代码生成控制不当”（代码注入）漏洞，攻击者可利用该漏洞进行代码注入。此问题影响所有从初始版本到 2.4.14.1 版本的 Broken Link Checker 插件。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102389
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WPMU DEV | Broken Link Checker | 0 ~ 2.4.14.1 | - |
|
II. Public POCs for CVE-2026-102389
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102389
请登录查看更多情报信息。
Other References for CVE-2026-102389 (1)
IV. Related Vulnerabilities
Same product: Broken Link Checker
-
CVE-2026-84772
WordPress Broken Link Checker plugin <= 2.4.14 - Server Side -
CVE-2026-75528
Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross -
CVE-2026-18937
Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query -
CVE-2026-39466
WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injectio -
CVE-2025-67962
WordPress Broken Link Checker plugin <= 1.2.6 - SQL Injectio
Same vendor: WPMU DEV
-
CVE-2026-108486
WordPress Forminator plugin <= 1.58.0 - Broken Access Contro -
CVE-2026-65459
WordPress Forminator plugin <= 1.57.3 - Arbitrary Content De -
CVE-2026-96341
WordPress Forminator plugin <= 1.57.3 - Privilege Escalation -
CVE-2026-102388
WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting -
CVE-2026-96336
WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulne
Same weakness: CWE-94
-
CVE-2026-86803
Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode E -
CVE-2026-54566
Markdown Preview Enhanced: Remote Code Execution via VM Sand -
CVE-2026-85714
Stirling-PDF: Remote Code Execution via H2 -
CVE-2026-108151
WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vu -
CVE-2026-103081
WordPress Salevo plugin <= 1.3.0 - Content Injection vulnera
V. Comments for CVE-2026-102389
No comments yet