Broken Link Checker: unauthenticated code execution (CVE-2026-18937)
A vulnerability, CVE-2026-18937 (CVSS 9), was published for the Broken Link Checker WordPress plugin. It does not limit which query variables it accepts from user input, so an unauthenticated user can overwrite arbitrary PHP global variables.
Checked in Shield: no
Who is affected
Broken Link Checker before 2.4.12 on sites using plain permalinks. Arbitrary code execution on the server is possible when a classic (non-block) theme is active.
How to check
In the WordPress admin, open Plugins and check the Broken Link Checker version. Then see Settings - Permalinks to find out whether Plain is selected, and confirm whether a classic theme is active.
How to fix
A patch exists: update the plugin to version 2.4.12 or later.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the issue is exploited in the wild is not disclosed yet. Source: the NVD entry for CVE-2026-18937.
