The Broken Link Checker WordPress plugin before version 2.4.12 does not filter which query variables are accepted from user input on sites using plain permalinks. This omission allows unauthenticated users to overwrite arbitrary PHP global variables and execute arbitrary code on the server when the classic (non‑block) theme is active. The weakness is a classic Code Injection identified as CWE‑94, and the potential impact is complete server compromise, affecting confidentiality, integrity, and availability of the affected WordPress site.

WordPress installations that have the Broken Link Checker plugin older than 2.4.12 and are configured to use plain permalink structures are vulnerable. The plugin’s vendor is listed as Unknown, and the affected releases include all versions prior to 2.4.12, notably 2.4.11 and earlier. The only documented fix is to upgrade the plugin to version 2.4.12 or later.

The CVSS score of 9 indicates a critical severity, while the EPSS score of less than 1% implies that, as of the latest data, exploitation incidents have been very rare. The vulnerability is not yet listed in CISA’s KEV catalog, but the impact remains severe because the attack requires no authentication and the exploit path is relatively straightforward. Attackers can trigger the vulnerability by sending crafted HTTP requests containing arbitrary query parameters to a publicly accessible WordPress site that uses the vulnerable plugin. No other conditions or privileged access are needed, so the risk to any such site is high.