{"id":"CVE-2026-96562","kind":"vulnerability","aliases":["CVE-2026-96562"],"related":[],"title":"WordPress Broken Link Checker plugin: unauthenticated shortcode execution via approved comments","description":"The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.","summary":"The Broken Link Checker plugin for WordPress, in all versions up to and including 2.4.14.1, passes unvalidated values to do_shortcode. An unauthenticated attacker can submit a comment with a crafted shortcode in an href or src attribute, and once a moderator approves it, WP-Cron runs the shortcode.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","wordpress"],"not_affected_if":["default-config"],"how_to_check":"- Check whether the Broken Link Checker plugin is installed and its version is `2.4.14.1` or lower in the WordPress plugins list\n- Review the sources for whether the plugin is active in wp-admin under Plugins","fix":"- Update the Broken Link Checker plugin to a version later than `2.4.14.1`\n- If no fixed version is available, deactivate and remove the plugin","status":"open","published_at":"2026-10-16T05:17:30+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:58:05+00:00","updated_at":"2026-10-25T03:58:05+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:58:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Broken Link Checker plugin to a version later than `2.4.14.1`\n- If no fixed version is available, deactivate and remove the plugin","reach":"internet","title":"WordPress Broken Link Checker plugin: unauthenticated shortcode execution via approved comments","impact":"medium","summary":"The Broken Link Checker plugin for WordPress, in all versions up to and including 2.4.14.1, passes unvalidated values to do_shortcode. An unauthenticated attacker can submit a comment with a crafted shortcode in an href or src attribute, and once a moderator approves it, WP-Cron runs the shortcode.","category":"runtime","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Arbitrary shortcodes run on the server after comment approval","analyst_note":"Confirm the fixed plugin version and whether a patch exists at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-96562 or the WordPress plugin changelog.","how_to_check":"- Check whether the Broken Link Checker plugin is installed and its version is `2.4.14.1` or lower in the WordPress plugins list\n- Review the sources for whether the plugin is active in wp-admin under Plugins","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running the Broken Link Checker plugin at version 2.4.14.1 or earlier are exposed, as long as a comment can reach moderation and be approved. Sites without the plugin, or running a later version, are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000644,"input_tokens":3421,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-96562':14A,17A '2.4.14.1':37B,94C 'action':106C 'allow':101C 'approv':10A,65B,146C,156C 'arbitrari':84C,127C 'attack':46B,124C,169C 'attribut':60B,144C 'automat':161C 'broken':2A,24B,75C 'checker':4A,26B,77C 'comment':11A,50B,134C,152C 'contain':135C 'craft':53B 'cron':69B,165C 'cve':12A,15A 'due':97C 'execut':8A,86C,104C,126C,160C 'exploit':129C 'host':21B 'href':57B,141C 'includ':36B,93C 'interact':170C 'link':3A,25B,76C 'make':119C 'moder':64B,153C 'normal':151C 'pass':38B 'payload':138C 'plugin':5A,27B,78C 'possibl':121C 'proper':110C 'requir':130C 'run':70B,115C 'runtim':18B 'self':20B 'self-host':19B 'shortcod':7A,43B,54B,72B,85C,117C,128C,137C,158C 'site':149C 'softwar':100C 'src':59B,143C 'submit':48B,133C 'unauthent':6A,45B,123C 'unvalid':39B 'user':102C 'valid':111C 'valu':40B,113C 'version':32B,89C 'via':9A,162C 'vulner':82C 'without':166C 'wordpress':1A,22B,29B,80C 'workflow':154C 'wp':68B,164C 'wp-cron':67B,163C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Broken Link Checker plugin at version 2.4.14.1 or earlier are exposed, as long as a comment can reach moderation and be approved. Sites without the plugin, or running a later version, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T05:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96562","severity":null,"published_at":"2026-10-16T05:17:30+00:00","modified_at":"2026-10-16T15:17:37+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}