The vulnerability is a missing capability check in the ajax_full_status and ajax_dashboard_status functions of the Broken Link Checker WordPress plugin. It allows any authenticated user with a Subscriber role or higher to call these AJAX endpoints and view the plugin’s status information that should be restricted to administrators. The flaw falls under CWE‑862 and results in an information disclosure, as attackers learn details about the site’s broken links and overall health, potentially aiding further attacks.

The defect impacts the WordPress plugin Broken Link Checker produced by wpmudev. All releases up to and including version 2.4.4 are affected, regardless of other plugins or WordPress core versions, as long as the plugin is installed on a site where users can authenticate at a Subscriber level or above.

The CVSS score of 4.3 reflects a moderate severity, and the EPSS score of less than 1% indicates that exploitation is currently unlikely. The plugin is not listed in the CISA KEV catalog, which reduces the visibility of existing exploitation. Exploitation requires an authenticated user with at least Subscriber rights to trigger the vulnerable AJAX calls. While it does not allow privilege escalation or code execution, the attacker gains visibility into internal site diagnostics, which may be used to plan subsequent targeting efforts.