---
id: "CVE-2026-96562"
kind: "vulnerability"
aliases: ["CVE-2026-96562"]
title: "WordPress Broken Link Checker plugin: unauthenticated shortcode execution via approved comments"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["runtime", "self-hosted", "wordpress"]
not_affected_if: ["default-config"]
published_at: "2026-10-16T05:17:30+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:58:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96562", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# WordPress Broken Link Checker plugin: unauthenticated shortcode execution via approved comments

The Broken Link Checker plugin for WordPress, in all versions up to and including 2.4.14.1, passes unvalidated values to do_shortcode. An unauthenticated attacker can submit a comment with a crafted shortcode in an href or src attribute, and once a moderator approves it, WP-Cron runs the shortcode.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Broken Link Checker plugin is installed and its version is `2.4.14.1` or lower in the WordPress plugins list
- Review the sources for whether the plugin is active in wp-admin under Plugins

## Fix

- Update the Broken Link Checker plugin to a version later than `2.4.14.1`
- If no fixed version is available, deactivate and remove the plugin

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96562

## From the sources

The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_