CVE-2026-18937: Broken Link Checker WordPress RCE Flaw

CVE-2026-18937 Overview

CVE-2026-18937 affects the Broken Link Checker WordPress plugin in versions before 2.4.12. The plugin fails to restrict which query variables it accepts from user input on sites using plain permalinks. Unauthenticated attackers can overwrite arbitrary PHP global variables through crafted requests. When a classic (non-block) theme is active, this variable overwrite leads to arbitrary code execution on the server. The flaw is classified under [CWE-94] Improper Control of Generation of Code.

Critical Impact
Unauthenticated remote attackers can execute arbitrary PHP code on vulnerable WordPress installations running the Broken Link Checker plugin with plain permalinks and a classic theme.

Affected Products

Broken Link Checker WordPress plugin versions prior to 2.4.12
WordPress sites configured with plain permalinks
WordPress sites running a classic (non-block) theme

Discovery Timeline

2026-08-19 - CVE-2026-18937 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-18937

Vulnerability Analysis

The Broken Link Checker plugin processes query variables from HTTP requests without validating an allow-list of accepted parameters. On WordPress sites using plain permalinks, the plugin binds attacker-controlled query variables directly into PHP global scope. This behavior enables an unauthenticated attacker to overwrite arbitrary PHP global variables during request processing.

When a classic theme is active, downstream code paths dereference globals that the attacker now controls. The attacker can steer execution into template rendering and inclusion logic. This results in arbitrary code execution in the context of the web server user. The vulnerability requires a specific site configuration, which raises attack complexity but does not require authentication or user interaction.

Root Cause

The root cause is missing input validation on query variable names accepted from user-supplied input. The plugin treats the incoming request parameter namespace as trusted. Combined with WordPress plain permalink parsing, this exposes internal PHP globals to external write access. The issue maps to [CWE-94] because attacker-controlled data ultimately flows into a code generation and execution path.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request containing query parameters whose names collide with sensitive PHP globals used by the active classic theme or by the plugin itself. The plugin registers these variables into global scope, and the classic theme rendering pipeline uses them during template resolution and inclusion. Successful exploitation yields code execution without any authentication.

No public proof-of-concept code has been verified. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-18937

Indicators of Compromise

Unexpected HTTP GET or POST requests containing unusual query parameter names that mirror PHP global variable identifiers
New or modified PHP files under wp-content/, wp-content/themes/, or wp-content/uploads/ that were not deployed by administrators
Web server processes spawning shells (sh, bash, cmd.exe) or outbound network connections to unfamiliar hosts
Access log entries targeting Broken Link Checker plugin endpoints from unauthenticated sources

Detection Strategies

Inventory WordPress sites and identify installations running Broken Link Checker below version 2.4.12
Correlate plugin version data with permalink structure and active theme type to isolate exploitable configurations
Inspect web access logs for requests with query strings that assign values to variables resembling PHP superglobals or theme internals

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root and theme directories
Forward web server access logs and PHP error logs to a centralized analytics platform for query-string anomaly detection
Alert on child processes launched by the PHP-FPM or web server user that are inconsistent with normal WordPress operation

How to Mitigate CVE-2026-18937

Immediate Actions Required

Update the Broken Link Checker plugin to version 2.4.12 or later on all WordPress installations
Audit sites for signs of prior exploitation, including new PHP files, modified theme files, and unexpected administrator accounts
Restrict administrative access to the WordPress dashboard using network controls until patching is confirmed

Patch Information

The vendor addressed the vulnerability in Broken Link Checker version 2.4.12 by restricting the set of query variables the plugin accepts from user input. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI. Refer to the WPScan Vulnerability Report for the disclosure record.

Workarounds

Switch the WordPress permalink structure away from plain permalinks to a rewritten format such as post name
Activate a block-based theme in place of a classic theme until the plugin is updated
Deactivate and remove the Broken Link Checker plugin on sites that cannot be updated immediately

bash

# Update Broken Link Checker using WP-CLI
wp plugin update broken-link-checker --version=2.4.12

# Change permalink structure away from plain
wp rewrite structure '/%postname%/' --hard

# Verify installed plugin version
wp plugin get broken-link-checker --field=version