CVE-2025-11734 Overview
CVE-2025-11734 affects the Broken Link Checker by AIOSEO WordPress plugin in all versions up to and including 1.2.5. The plugin registers a REST API endpoint that fails to verify user permissions on the specific post being targeted. Authenticated attackers with contributor-level access or higher can trash arbitrary posts through the DELETE /wp-json/aioseoBrokenLinkChecker/v1/post endpoint. The flaw is categorized under [CWE-862] Missing Authorization.
Critical Impact
Low-privileged users can move arbitrary posts to trash, disrupting content availability and site integrity on affected WordPress installations.
Affected Products
- Broken Link Checker by AIOSEO plugin for WordPress, versions 1.2.5 and earlier
- WordPress sites permitting contributor-level or higher accounts on the affected plugin
- Multi-author WordPress deployments using the vulnerable plugin
Discovery Timeline
- 2025-11-18 - CVE-2025-11734 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11734
Vulnerability Analysis
The Broken Link Checker by AIOSEO plugin exposes a REST API route intended for managing links flagged as broken. The route accepts DELETE requests at /wp-json/aioseoBrokenLinkChecker/v1/post to trash posts referenced by broken link records. The endpoint's permission callback confirms only that the requesting user holds the aioseo_blc_broken_links_page capability. This capability is granted broadly, extending to contributor-level accounts.
Because the endpoint never re-checks whether the caller can edit or delete the specific post identified in the request, any authenticated user with the broad capability can trash posts owned by other authors, including administrators and editors. The vulnerability produces integrity and availability impact without exposing confidential data.
Root Cause
The root cause is a missing per-object authorization check. WordPress exposes granular capability checks such as current_user_can( 'delete_post', $post_id ) for exactly this scenario. The plugin's permission callback relies on a coarse-grained page-access capability instead of validating rights against the target post. This omission is a textbook Missing Authorization weakness [CWE-862].
Attack Vector
Exploitation requires an authenticated session at the contributor role or higher. The attacker authenticates to WordPress, obtains a valid REST nonce, and issues a DELETE request to the vulnerable route with the target post identifier in the request body. The plugin resolves the post reference and calls wp_trash_post() without verifying ownership. Successful requests move the target post to trash, removing it from public view until an administrator restores it.
Refer to the Wordfence Vulnerability Report for the endpoint behavior and to the WordPress Plugin Changeset for the corrective code diff.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-11734
Indicators of Compromise
- Unexpected posts appearing in the WordPress trash without corresponding administrator or author activity
- HTTP access log entries recording DELETE requests to /wp-json/aioseoBrokenLinkChecker/v1/post
- Post status transitions to trash initiated by contributor-level accounts in the wp_posts audit trail
Detection Strategies
- Enable REST API request logging on the WordPress host and alert on DELETE calls to the aioseoBrokenLinkChecker/v1 namespace originating from non-privileged roles
- Correlate post_status changes in the database with the acting user's capability set to flag deletions performed by contributors
- Review WordPress activity plugins or audit logs for wp_trash_post events tied to accounts that do not own the affected posts
Monitoring Recommendations
- Alert on spikes in trashed posts across a short interval, which may indicate scripted abuse of the endpoint
- Monitor authentication logs for newly registered contributor accounts followed by REST API activity against the plugin route
- Track plugin version inventory across WordPress sites to identify installations still running 1.2.5 or earlier
How to Mitigate CVE-2025-11734
Immediate Actions Required
- Update the Broken Link Checker by AIOSEO plugin to the version published in changeset 3390304 or later
- Audit contributor and author accounts and disable any that are unused or unrecognized
- Restore any posts found in the trash that were not removed by their legitimate authors
Patch Information
The vendor addressed the missing authorization check in the plugin update tracked by WordPress Plugin Changeset 3390304. The fix enforces a per-post capability check inside the REST endpoint's permission callback so that only users authorized to edit or delete the specific post can invoke the trash action. Administrators should apply the update through the WordPress plugin manager or WP-CLI.
Workarounds
- Restrict the plugin to trusted roles by temporarily deactivating it on sites that allow contributor registration
- Block external access to /wp-json/aioseoBrokenLinkChecker/v1/post at the web application firewall or reverse proxy until the patch is applied
- Tighten role assignments so that unknown or self-registered users cannot obtain the aioseo_blc_broken_links_page capability
# Configuration example: update the plugin using WP-CLI
wp plugin update broken-link-checker-seo
wp plugin get broken-link-checker-seo --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
