CVE-2026-97316 in Broken Link Notifier Plugin
Summary
by MITRE • 09/30/2026
The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in versions of the Broken Link Notifier WordPress plugin prior to release 2.0.0.1 stems from a fundamental flaw in how the application handles HTTP redirect chains during link validation processes. When the plugin scans posts and pages for broken links, it initiates outbound requests to verify the status codes returned by target URLs. However, the implementation fails to re-validate or restrict the destination of any intermediate redirects encountered during this process. This oversight creates a significant security gap because while the initial request might be directed toward an external domain that is permitted by the plugin's configuration, subsequent redirects can point the server toward internal network addresses or local services that are otherwise inaccessible from the public internet.
This behavior effectively allows unauthenticated attackers to leverage the WordPress application as a proxy for making arbitrary HTTP requests on behalf of the web server. By crafting specific URLs that trigger a redirect loop or chain leading back to private IP ranges, such as 127.0.0.1 or internal subnet addresses, an attacker can force the vulnerable plugin to interact with services running within the local network environment. This capability bypasses standard perimeter defenses and access control lists designed to protect internal infrastructure from external exposure. The flaw is particularly dangerous because it does not require any form of authentication, meaning any visitor to a website utilizing this compromised version of the plugin can exploit the issue without prior credentials or privileges.
The operational impact of this vulnerability extends beyond simple information disclosure. By directing server-side requests toward internal services, attackers may be able to probe for open ports, identify running service versions, and potentially interact with administrative interfaces that are not intended to be exposed externally. In more severe scenarios, if the internal services have known vulnerabilities or lack proper authentication mechanisms themselves, this SSRF vector could serve as a stepping stone for further exploitation within the network. This aligns directly with CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where web applications fetch remote resources without validating user-supplied URLs. Furthermore, from an offensive security perspective, this technique is consistent with MITRE ATT&CK tactic T1557, specifically the Adversary-in-the-Middle sub-technique, as it allows an attacker to position themselves between clients and servers or manipulate traffic flows within a trusted network segment.
To mitigate this risk, organizations must immediately update the Broken Link Notifier plugin to version 2.0.0.1 or later, where these validation checks have been corrected to enforce strict allow-listing of redirect destinations. In addition to patching, administrators should implement server-level controls such as web application firewalls that inspect outbound traffic for requests targeting private IP ranges and block them at the network perimeter. It is also advisable to review WordPress configurations to ensure that plugins with external request capabilities are kept up-to-date and that unnecessary HTTP functions are disabled if not required by other site functionalities, thereby reducing the attack surface available for SSRF exploitation attempts.