CVE-2026-96562: Broken Link Checker WordPress Plugin RCE

CVE-2026-96562 is a remote code execution vulnerability in Broken Link Checker WordPress plugin allowing arbitrary shortcode execution. Attackers can exploit approved comments to run malicious code via WP-Cron. This article covers technical details, affected versions, impact analysis, and mitigation strategies.

CVE-2026-96562 Overview

CVE-2026-96562 affects the Broken Link Checker plugin for WordPress through version 2.4.14.1. The plugin invokes do_shortcode on values parsed from comment link attributes without proper validation. Unauthenticated attackers can submit comments containing shortcode payloads in href or src attributes. Once a site moderator approves the comment, WP-Cron automatically executes the embedded shortcodes without further attacker interaction. This arbitrary shortcode execution flaw is classified under [CWE-94] (Improper Control of Generation of Code).

Critical Impact
Attackers can trigger execution of arbitrary WordPress shortcodes on affected sites, enabling abuse of any shortcode registered by the site's active plugins or themes.

Affected Products

Broken Link Checker plugin for WordPress — all versions up to and including 2.4.14.1
WordPress sites with comment moderation workflows enabled
Sites running the plugin alongside additional plugins or themes that register sensitive shortcodes

Discovery Timeline

2026-10-16 - CVE-2026-96562 published to the National Vulnerability Database
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-96562

Vulnerability Analysis

The Broken Link Checker plugin scans post and comment content for links, then processes the extracted values through WordPress's do_shortcode function. The plugin's link parsers in legacy/modules/parsers/html_link.php and legacy/modules/parsers/image.php extract href and src attribute values from HTML. These values are passed to downstream handlers that invoke shortcode processing without first stripping or validating shortcode syntax. An attacker submits a comment where the link attribute itself contains a shortcode payload. After a legitimate moderator approves the comment, the scheduled WP-Cron link-checking job expands any registered shortcode found in the attribute. The attacker needs no account, no authentication, and no further interaction once the comment is approved.

Root Cause

The root cause is improper input validation on attribute values prior to code generation. The plugin treats comment-derived link attributes as trusted data and routes them through do_shortcode rather than treating them as opaque URLs. Any shortcode registered on the target site becomes reachable through this path.

Attack Vector

Exploitation occurs over the network through the standard WordPress comment submission interface. The attacker posts a comment containing an anchor or image tag whose href or src carries the shortcode payload. The attack completes when comment moderation approves the submission and WP-Cron runs the broken-link scan.

No verified public exploit code is available. Technical details and the vulnerable code paths are documented in the plugin source: Broken Link Checker containers.php, comment.php, html_link.php parser, and image.php parser.

Detection Methods for CVE-2026-96562

Indicators of Compromise

Approved comments whose href or src attributes contain bracketed shortcode syntax such as [shortcode_name] instead of a URL scheme.
Unexpected WP-Cron executions of blc_cron_check_links producing output or side effects consistent with shortcode handlers rather than HTTP link checks.
New posts, users, options, or outbound HTTP requests originating during scheduled Broken Link Checker scans.

Detection Strategies

Query the wp_comments table for approved rows where comment content matches a regex detecting href="\[ or src="\[ patterns.
Monitor the plugin's internal link tables (wp_blc_links, wp_blc_instances) for URL values that begin with [ characters.
Review web server access logs for POST requests to wp-comments-post.php containing bracketed shortcode markers in form bodies.

Monitoring Recommendations

Enable WordPress debug logging around WP-Cron executions and alert on PHP errors or warnings emitted during Broken Link Checker runs.
Audit newly created administrator accounts, modified options in wp_options, and changes to active plugin files after comment moderation events.
Forward WordPress and web server logs to a central analytics platform such as Singularity Data Lake to correlate comment approvals with subsequent cron-driven activity.

How to Mitigate CVE-2026-96562

Immediate Actions Required

Update the Broken Link Checker plugin to a version later than 2.4.14.1 that contains the fix referenced in the plugin changeset.
Review the pending and recently approved comment queue for entries containing shortcode syntax inside link attributes and reject them before approval.
Audit site content, user accounts, and plugin files for changes made after any suspicious comment approval.

Patch Information

The vendor addressed the issue in the version following 2.4.14.1. Review the Wordfence vulnerability report for the fixed version and the plugin changeset for the exact code modifications applied to the shortcode handling path.

Workarounds

Deactivate the Broken Link Checker plugin until the patched version is installed.
Require administrator-level approval for all comments and reject any comment containing bracketed text inside href or src attributes.
Disable WP-Cron execution for the plugin's scheduled scan hooks until the plugin is updated.

bash

# Disable the plugin from the WP-CLI command line until patched
wp plugin deactivate broken-link-checker

# After updating, confirm the installed version is above 2.4.14.1
wp plugin get broken-link-checker --field=version