Description
The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Published: 2025-07-11
Score: 4.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: CSV injection enabling local code execution when uploaded files are opened by authenticated users with Contributor or higher role
Action: Update plugin
AI Analysis

Impact

The Broken Link Notifier plugin contains a CSV Injection flaw that allows authenticated users who have Contributor-level or higher privileges to embed malicious spreadsheet formulas into exported CSV files. When a user opens such a file in a spreadsheet application that evaluates formulas, the injected content can execute arbitrary code on the local system. The vulnerability is classified as CWE‑1236.

Affected Systems

All releases of the Broken Link Notifier plugin for WordPress up to and including version 1.3.0 are affected. The plugin is released by vendor apos37 and is distributed through the WordPress plugin repository.

Risk and Exploitability

The CVSS base score of 4.1 indicates a moderate severity that requires authentication. The EPSS score is less than 1%, implying a low likelihood of widespread exploitation, and the issue is not listed in the CISA KEV catalog. Attackers must first use the exporter to create the CSV, then persuade a user with a vulnerable spreadsheet application to open the file. Successful exploitation results in code execution on the local machine only when the file is processed.

Generated by OpenCVE AI on April 20, 2026 at 20:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Broken Link Notifier plugin to the latest version that addresses the CSV injection flaw.
  • If an upgrade cannot be applied immediately, remove or restrict the CSV export function for users with Contributor-level or higher permissions to prevent injection opportunities.
  • Continuously monitor WordPress installations for unauthorized or modified CSV files and verify that any exported data does not contain unexpected formulas.

Generated by OpenCVE AI on April 20, 2026 at 20:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-21124 The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
History

Fri, 11 Jul 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00034}

Fri, 11 Jul 2025 08:30:00 +0000

Type Values Removed Values Added
Description The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Title Broken Link Notifier <= 1.3.0 - Authenticated (Contributor+) CSV Injection
Weaknesses CWE-1236
References
Metrics cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:24:11.458Z

Reserved: 2025-06-27T18:38:38.615Z

Link: CVE-2025-6838

cve-icon Vulnrichment

Updated: 2025-07-11T15:25:25.078Z

cve-icon NVD

Status : Deferred

Published: 2025-07-11T09:15:25.200

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-6838

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-20T20:30:16Z

Weaknesses