The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin includes a REST API endpoint that permits deletion of any post. The endpoint checks only for the capability aioseo_blc_broken_links_page, which is granted to Contributor users and higher, but does not verify ownership or specific permissions for the target post. An attacker who is authenticated as a Contributor or above can therefore send a DELETE request to /wp-json/aioseoBrokenLinkChecker/v1/post and move any post to the trash. This results in loss of content and can function as a denial‑of‑service attack against the site’s editorial workflow. The weakness is a missing authorization check, identified as CWE‑862.

The vulnerability affects the WordPress plugin Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links in all releases up to and including version 1.2.5. No additional product or version details were provided.,

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack requires authentication as a user with at least Contributor level, but once authenticated the attacker can delete any post without further authorization checks. The exploit path is straightforward: authenticate, send a DELETE request to the REST endpoint, and target any post ID. Monitoring logs or disabling the endpoint are mitigations, but the preferred action is to apply a patch that removes the authorization flaw.