The Broken Link Checker plugin allows an attacker to insert a shortcode payload into the href or src attribute of a comment. When the comment is approved, the plugin runs do_shortcode without proper validation, enabling the arbitrary execution of the supplied shortcode. This flaw maps to CWE-94, an improper validation of code used for execution. The result can include remote code execution or other malicious actions depending on the shortcode’s purpose, compromising the integrity and confidentiality of the site.

The vulnerability affects the WordPress plugin Broken Link Checker from WPMUDEV, versions 2.4.14.1 and earlier. No other products are listed. Users of these versions should identify if the plugin is installed and determine the exact version to assess impact.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of <1% indicates a very low probability of exploitation worldwide, though it is not listed in CISA’s KEV catalog. The attack does not require authentication; it relies on a user submitting a comment, which must then be approved via the normal moderation workflow. Once approved, the shortcode is executed automatically by WP‑Cron, requiring no further attacker interaction. Given the ease of triggering the vulnerability and the lack of technical barriers, the risk to sites running affected versions remains significant enough to warrant prompt action.