CVE-2025-4047: Broken Link Checker WordPress Plugin Flaw

CVE-2025-4047 Overview

CVE-2025-4047 is a missing authorization vulnerability in the Broken Link Checker plugin for WordPress. The flaw affects all versions up to and including 2.4.4. The plugin fails to enforce capability checks on the ajax_full_status and ajax_dashboard_status AJAX endpoints. Authenticated users with Subscriber-level access or higher can query these endpoints to view the plugin's status information. The issue is tracked as CWE-862 Missing Authorization.

Critical Impact
Authenticated attackers with low-privilege Subscriber accounts can access plugin status data that should be restricted to administrators.

Affected Products

Broken Link Checker plugin for WordPress
All versions through 2.4.4
WordPress sites permitting Subscriber-level registration

Discovery Timeline

2025-06-03 - CVE-2025-4047 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4047

Vulnerability Analysis

The Broken Link Checker plugin registers two AJAX handlers, ajax_full_status and ajax_dashboard_status, that return operational status data about the link-checking engine. These handlers are wired into the wp_ajax_ action hook, which authenticates the caller but does not, by itself, restrict privilege level.

The handlers omit a current_user_can() capability check and lack any role-based gating. Any authenticated session, including a Subscriber, can invoke these endpoints and receive plugin state information intended for administrators.

The impact is limited to confidentiality of plugin status data. The vulnerability does not permit modification of settings, execution of code, or disruption of service. Sites that allow open user registration face the broadest exposure because attackers can self-provision Subscriber accounts.

Root Cause

The root cause is missing authorization on privileged AJAX callbacks. The plugin authors relied on authentication as an access gate instead of validating that the caller holds an administrative capability such as manage_options. This pattern is common when developers assume AJAX endpoints are internal and overlook that any logged-in user can invoke admin-ajax.php.

Attack Vector

Exploitation requires a valid WordPress account with at least the Subscriber role. The attacker sends a POST request to /wp-admin/admin-ajax.php specifying the action parameter as full_status or dashboard_status, with a valid session cookie. The server returns the plugin's status payload without checking the caller's capabilities. Reference the plugin source at line 3272 and the fix in changeset 3294992 for the specific handler code and the added capability check.

Detection Methods for CVE-2025-4047

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=full_status or action=dashboard_status originating from Subscriber-level accounts.
Unexpected AJAX requests to Broken Link Checker endpoints from user accounts that have no administrative purpose on the site.
Newly created low-privilege accounts followed shortly by AJAX calls to plugin management endpoints.

Detection Strategies

Parse web server access logs for admin-ajax.php requests containing the full_status or dashboard_status actions and correlate the associated user ID against expected roles.
Enable WordPress audit logging to record AJAX invocations along with the caller's role and session context.
Alert when non-administrative accounts issue requests to plugin AJAX handlers that expose configuration or status data.

Monitoring Recommendations

Baseline normal AJAX traffic patterns for the Broken Link Checker plugin and flag deviations by role.
Track user-registration spikes on sites that expose public sign-up, particularly when followed by activity against admin-ajax.php.
Forward WordPress and web server logs to a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2025-4047

Immediate Actions Required

Update the Broken Link Checker plugin to a version later than 2.4.4 that contains the fix from changeset 3294992.
Audit WordPress user accounts and remove unnecessary Subscriber-level accounts, especially on sites with open registration.
Disable public user registration if it is not required for site functionality.

Patch Information

The maintainers addressed the flaw in the commit recorded as WordPress plugin changeset 3294992. The patch adds capability validation to the ajax_full_status and ajax_dashboard_status handlers so only users with administrative privileges can retrieve plugin status. Additional context is available in the Wordfence vulnerability report.

Workarounds

Deactivate the Broken Link Checker plugin until the update is applied.
Restrict access to /wp-admin/admin-ajax.php at the web application firewall to block Subscriber-level users from invoking the affected actions.
Enforce role-based restrictions using a security plugin that adds capability checks to unprotected AJAX endpoints.

bash

# Configuration example: block the vulnerable AJAX actions at the WAF layer
# Nginx snippet
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^(full_status|dashboard_status)$") {
        return 403;
    }
}