CVE-2026-18937— Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection
Quick assessment
Affected
Unknown Broken Link Checker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在启用纯链接（plain permalinks）的网站上，Broken Link Checker WordPress 插件 2.4.12 之前的版本未对用户输入接受的查询变量进行限制，导致未认证的攻击者能够覆盖任意 PHP 全局变量，并在经典（非块编辑器）模式下执行任意代码。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Broken Link Checker | < 2.4.12 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-18937
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection
Source: CVE Program / CVE List V5
Vulnerability Description
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Broken Link Checker | 0 ~ 2.4.12 | - |
|
II. Public POCs for CVE-2026-18937
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18937
请登录查看更多情报信息。
News Coverage for CVE-2026-18937 (1)
-
🔗 Broken Link Checker < 2.4.12 – Unauthenticated RCE via Query Variable Injection | CVE 2026-18937 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-19 · 38 CVEs total
| CVE-2026-18779 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record De | |
| CVE-2026-18031 | TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback | |
| CVE-2026-17565 | Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery | |
| CVE-2026-18466 | WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation | |
| CVE-2026-18051 | W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Ove | |
| CVE-2026-18231 | WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user | |
| CVE-2026-18202 | JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-18776 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJA | |
| CVE-2026-18778 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multi | |
| CVE-2026-18777 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Chan | |
| CVE-2026-16979 | SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key En | |
| CVE-2026-19055 | ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters | |
| CVE-2026-19709 | Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consu | |
| CVE-2026-19056 | ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter | |
| CVE-2026-19416 | KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR | |
| CVE-2026-19406 | Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appoint | |
| CVE-2026-19417 | KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR | |
| CVE-2026-19782 | WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users | |
| CVE-2026-19842 | SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SA | |
| CVE-2026-14334 | Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SV |
Showing top 20 of 38 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Broken Link Checker
-
CVE-2026-39466
WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injectio -
CVE-2025-67962
WordPress Broken Link Checker plugin <= 1.2.6 - SQL Injectio -
CVE-2025-4047
Broken Link Checker <= 2.4.4 - Missing Autorization to Authe -
CVE-2024-10903
Broken Link Checker < 2.4.2 - Admin+ SSRF -
CVE-2024-8981
Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scriptin
Same vendor: Unknown
-
CVE-2026-78146
Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_ -
CVE-2026-77695
Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest -
CVE-2026-77757
Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move v -
CVE-2026-77758
Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticate -
CVE-2026-77789
Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer
V. Comments for CVE-2026-18937
No comments yet