WordPress Plugin Vulnerabilities

Broken Link Checker < 2.4.14.1 - Editor+ SSRF

Description

The plugin is vulnerable to Server-Side Request Forgery, making it possible for authenticated attackers, with editor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
broken-link-checker
Fixed in 2.4.14.1

References

CVE
CVE-2026-84772
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6bfdf424-5afd-4af0-a19c-bfb115450747

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
4.1 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
45753d05-72ff-43c6-a84a-1d929d66b331

Timeline

Publicly Published
2026-09-02 (about 1 month ago)
Added
2026-09-09 (about 1 month ago)
Last Updated
2026-09-09 (about 1 month ago)

Other

Published
Title
Published
2025-03-28
Title
WP Compress for MainWP < 6.30.06 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2025-02-17
Title
ProfileGrid – User Profiles, Groups and Communities < 5.9.4.3 - Authenticated (Subscriber+) Limited Server-Side Request Forgery
Published
2026-02-24
Title
Responsive Lightbox & Gallery < 2.7.2 - Authenticated (Author+) Server-Side Request Forgery via Remote Library Image Upload
Published
2026-03-02
Title
Ratatouille <= 1.2.6 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2024-04-12
Title
ActiveCampaign < 8.1.15 - Authenticated (Administrator+) Server-Side Request Forgery