CVE-2026-39466: Broken Link Checker SQL Injection Flaw

CVE-2026-39466 Overview

CVE-2026-39466 is a blind SQL injection vulnerability in the WPMU DEV Broken Link Checker plugin for WordPress. The flaw affects all versions of broken-link-checker up to and including 2.4.7. Improper neutralization of special elements passed to SQL commands [CWE-89] allows an authenticated attacker with high privileges to inject database queries. Successful exploitation can disclose sensitive WordPress database contents and degrade site availability. The vulnerability carries a network attack vector with no user interaction and a scope change, which means impact can extend beyond the vulnerable component.

Critical Impact

Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing user credentials, session tokens, and configuration data stored in wp_options.

Affected Products

• WPMU DEV Broken Link Checker plugin for WordPress
• All versions from initial release through 2.4.7
• WordPress installations using broken-link-checker up to 2.4.7

Discovery Timeline

• 2026-04-08 - CVE-2026-39466 published to NVD
• 2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-39466

Vulnerability Analysis

The Broken Link Checker plugin scans WordPress content for broken hyperlinks and reports them in the administrative dashboard. The plugin builds SQL queries that incorporate user-supplied input without parameterization or proper escaping. An attacker with administrative or editor-level access can submit crafted input that alters query logic. Because the injection is blind, the attacker infers data through boolean or time-based responses rather than direct output.

The vulnerability falls under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. Exploitation does not require user interaction once the attacker holds the required privileges. The scope is changed, meaning a successful attack affects resources beyond the plugin itself, including the underlying WordPress database tables.

Root Cause

The root cause is the construction of dynamic SQL statements using concatenation of unsanitized request parameters. The plugin fails to use $wpdb->prepare() consistently for query construction. Special SQL metacharacters such as single quotes, comments, and UNION operators pass through to the database engine unmodified.

Attack Vector

An attacker authenticated with high-privilege access submits crafted parameters to a vulnerable plugin endpoint. The injected payload uses conditional statements and time delays to extract data one bit at a time. Refer to the Patchstack SQL Injection Vulnerability advisory for technical details.

Detection Methods for CVE-2026-39466

Indicators of Compromise

• Unusual administrative requests to Broken Link Checker plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or BENCHMARK.
• Spikes in database query execution time correlated with WordPress admin sessions.
• Anomalous reads against wp_users, wp_usermeta, or wp_options tables originating from the plugin's PHP processes.

Detection Strategies

• Inspect WordPress access logs for POST and GET requests to wp-admin/admin.php or AJAX endpoints registered by broken-link-checker containing encoded SQL metacharacters.
• Enable MySQL or MariaDB general query logging temporarily and search for malformed queries originating from the plugin.
• Deploy a web application firewall rule that flags SQL injection patterns targeting plugin parameters.

Monitoring Recommendations

• Monitor authentication events for high-privilege WordPress accounts and alert on anomalous administrative actions.
• Track plugin version inventory across managed WordPress sites and flag installations running broken-link-checker 2.4.7 or earlier.
• Correlate web server, PHP-FPM, and database logs in a central data lake to surface SQL injection chains.

How to Mitigate CVE-2026-39466

Immediate Actions Required

• Update the Broken Link Checker plugin to a version newer than 2.4.7 as soon as a patched release is available from WPMU DEV.
• Audit administrative and editor accounts and rotate credentials for users who do not require elevated access.
• Restrict access to the WordPress administrative interface using IP allowlists or VPN gateways.

Patch Information

WPMU DEV maintains the Broken Link Checker plugin through the WordPress plugin repository. Consult the Patchstack SQL Injection Vulnerability advisory for the fixed version and apply it through the WordPress plugin update workflow.

Workarounds

• Deactivate and remove the Broken Link Checker plugin until a fixed version is installed.
• Apply a virtual patch at the web application firewall layer that blocks SQL metacharacters in plugin parameters.
• Enforce least privilege by demoting accounts that do not require administrator or editor capabilities.

# Configuration example
wp plugin update broken-link-checker
wp plugin deactivate broken-link-checker
wp user list --role=administrator --fields=ID,user_login,user_email