This vulnerability is an SQL injection flaw caused by improper neutralization of special elements in an SQL command within the AIOSEO Plugin Team Broken Link Checker. An attacker could inject arbitrary SQL statements, potentially retrieving, modifying, or deleting sensitive database information. The likely attack vector is through the plugin’s publicly accessible link checking functionality, as the issue is exposed via web requests.

The affected product is the WordPress plugin ‘Broken Link Checker’ from the AIOSEO Plugin Team. All versions up to and including 1.2.6 are vulnerable. No specific third‑party vendors or additional products are listed as affected.

The CVSS score of 7.6 indicates high severity, but the EPSS score of less than 1% suggests a very low exploitation probability at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require sending a crafted request to the plugin’s link checking endpoint; authentication is not required as the plugin is publicly accessible. Due to the high potential impact, the risk remains significant despite the low likelihood.