CVE-2026-84772 in Broken Link Checker Plugin
Summary
by MITRE • 09/02/2026
Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as Server-Side Request Forgery, or SSRF, within the Broken Link Checker plugin for WordPress prior to version 2.4.14 represents a critical security flaw that allows an attacker to manipulate server-side network requests. This type of attack occurs when a web application fetches a remote resource without validating the user-supplied URL. In this specific context, the vulnerability stems from insufficient input validation and sanitization mechanisms within the plugin's codebase. When users or administrators provide URLs for link checking operations, the application processes these inputs directly to initiate HTTP requests on behalf of the server. Because the system does not adequately verify whether the target destination is internal, external, or potentially malicious, it becomes possible for an attacker to craft specific URL payloads that redirect the server's request toward unintended destinations.
From a technical perspective, this flaw aligns with CWE-918, which defines Server-Side Request Forgery as a vulnerability where a web application fetches a remote resource without validating the user-supplied URL. The operational impact of such a vulnerability is severe because it effectively turns the vulnerable server into an open proxy or a pivot point for further attacks. An attacker can leverage this capability to scan internal network services that are not exposed to the public internet, potentially discovering sensitive information hosted on local databases, administrative interfaces, or cloud metadata endpoints. For instance, accessing cloud provider metadata services like AWS EC2 Instance Metadata Service is a common exploitation vector in SSRF scenarios, which could lead to the compromise of long-term credentials and subsequent full control over the underlying infrastructure.
This vulnerability also maps directly to MITRE ATT&CK technique T1557, known as Adversary-in-the-Middle or Lateral Tool Transfer when used for network reconnaissance, and more broadly falls under the category of server-side request forgery which is often utilized in conjunction with other attack chains such as Remote Code Execution. By exploiting this flaw, an attacker can bypass firewalls and access control lists that are designed to protect internal resources from external threats. The ability to make requests from the server's IP address makes it significantly harder for network security monitoring tools to distinguish between legitimate administrative traffic and malicious exploitation attempts, thereby increasing the window of opportunity for undetected intrusion.
To mitigate this risk, immediate action is required by upgrading the Broken Link Checker plugin to version 2.4.14 or later, where these input validation checks have been properly implemented. In addition to updating the software, administrators should implement strict allow-listing policies for outbound HTTP requests if such functionality is supported by their hosting environment or web application firewall configurations. It is also advisable to restrict server-side network access using security groups and firewalls to limit which internal IP ranges can be reached from the web server layer. Regular auditing of plugin codebases and maintaining a policy of least privilege for service accounts further reduces the attack surface associated with SSRF vulnerabilities, ensuring that even if similar flaws are introduced in future updates, their potential impact remains contained.