The WPMU DEV Broken Link Checker plugin contains an improper control of code generation vulnerability that allows attackers to inject arbitrary code into the WordPress site. This flaw can let a malicious actor execute locally‑crafted payloads or hijack site functionality, thereby compromising the confidentiality, integrity, or availability of the affected site.

WordPress installations that have the Broken Link Checker plugin installed in any version up to and including 2.4.14.1 are affected. The vulnerability is present in all revisions from the earliest available release through 2.4.14.1.

The CVSS score of 6.5 classifies the vulnerability as medium severity, and the EPSS score of < 1 % indicates a low probability of widespread exploitation at present. The plugin is not listed in CISA's KEV catalog. Based on the description, the likely attack vector would involve an authenticated WordPress administrator or another user with permission to configure the plugin, as the injection is performed via the plugin's code generation mechanisms. The vulnerability is not noted as remote code execution by default, but the ability to inject arbitrary code raises the risk of complete site compromise.