CVE-2026-84772 Overview
CVE-2026-84772 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Broken Link Checker plugin for WordPress in versions up to and including 2.4.14. The flaw resides in the plugin's editor functionality and allows an authenticated user with high privileges to coerce the WordPress server into issuing outbound HTTP requests to attacker-controlled destinations. The weakness is classified under CWE-918, Server-Side Request Forgery. Successful exploitation can expose internal network resources, cloud metadata endpoints, or other services reachable from the WordPress host.
Critical Impact
An authenticated attacker can abuse the plugin editor to send server-originated HTTP requests, enabling reconnaissance of internal services and limited disclosure of restricted content.
Affected Products
- WordPress Broken Link Checker plugin versions <= 2.4.14
- WordPress sites with the vulnerable plugin installed and active
- Hosting environments where WordPress can reach internal or metadata services
Discovery Timeline
- 2026-09-02 - CVE-2026-84772 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84772
Vulnerability Analysis
The Broken Link Checker plugin scans WordPress content for outbound URLs and validates their reachability. The editor component allows privileged users to submit or modify URLs that the plugin then fetches server-side. The plugin does not adequately restrict the destination of these requests, permitting requests to internal IP ranges, loopback interfaces, and non-HTTP schemes reachable from the WordPress host.
An attacker holding high-privilege credentials (such as an editor or administrator role) can direct the plugin to request arbitrary URLs. The plugin returns response metadata or content, which leaks information about internal services. This turns the WordPress server into a proxy for attacker-driven requests inside the hosting network.
The scope change indicated in the CVSS vector reflects that requests originate from the WordPress backend but reach resources outside the plugin's intended boundary. Confidentiality and integrity impact remain limited because the attacker cannot fully control the request body or headers.
Root Cause
The root cause is missing validation of user-supplied URLs before the plugin issues outbound HTTP requests. The editor endpoint accepts a target URL and passes it to the link-checking routine without filtering internal address ranges, cloud metadata IPs (such as 169.254.169.254), or private CIDR blocks. This aligns with the SSRF pattern documented in CWE-918.
Attack Vector
Exploitation requires network access to the WordPress admin interface and an authenticated session with elevated privileges. The attacker submits a crafted URL through the plugin's editor workflow. The plugin fetches the URL server-side and returns status or response information to the attacker. See the Patchstack SSRF Vulnerability Report for advisory details.
Detection Methods for CVE-2026-84772
Indicators of Compromise
- Outbound HTTP requests from the WordPress host to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local addresses (169.254.0.0/16)
- Unexpected access attempts to cloud instance metadata endpoints from the web server process
- Entries in the Broken Link Checker log referencing non-content URLs targeting internal services
Detection Strategies
- Review web server and PHP process egress traffic for requests originating from the WordPress runtime to RFC1918 or metadata IPs
- Audit WordPress wp_options and Broken Link Checker database tables for URLs that reference internal hostnames or IPs
- Correlate admin session activity with outbound HTTP connections from the WordPress server
Monitoring Recommendations
- Enable egress filtering logs on hosts running WordPress and alert on connections to private ranges
- Monitor authentication logs for high-privilege WordPress accounts and correlate with plugin activity
- Track plugin version inventory across WordPress deployments to identify unpatched instances of Broken Link Checker
How to Mitigate CVE-2026-84772
Immediate Actions Required
- Update the Broken Link Checker plugin to a version later than 2.4.14 as soon as the vendor releases a fix
- Restrict outbound network access from the WordPress host to prevent connections to internal and metadata IP ranges
- Review and reduce the number of accounts holding editor or administrator privileges on affected WordPress sites
Patch Information
Refer to the Patchstack SSRF Vulnerability Report for vendor patch status and fixed version details. Apply the update through the WordPress plugin manager or by replacing the plugin files manually.
Workarounds
- Temporarily deactivate the Broken Link Checker plugin until a patched release is installed
- Deploy a web application firewall rule that blocks admin-post requests submitting URLs targeting private address space
- Use host-level firewall rules to deny outbound traffic from the web server to 169.254.169.254 and internal subnets not required for operation
# Example iptables rule to block metadata endpoint access from the WordPress host
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.