CVE-2026-18937

The Broken Link Checker WordPress plugin before 2.4.12 fails to restrict accepted query variables on plain-permalink sites, allowing unauthenticated attackers to overwrite arbitrary PHP globals and achieve remote code execution when a classic editor is active. Upgrade to 2.4.12 or later. Exploita...