abraxas/cve-2026-18937Proof-of-concept exploit and lab reproduction pack for CVE-2026-18937, an unauthenticated RCE in the Broken Link Checker WordPress plugin before 2.4.12.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-18937
Broken Link Checker 2.4.11 — Unknown
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
| CVE | CVE-2026-18937 · CVE.org |
| CWE | CWE-94 |
| CVSS | Critical: 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Product | Broken Link Checker |
| Affected | all versions through 2.4.11 (inclusive) |
| Patched | 2.4.12 and later |
| Auth | none (see source map) |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only · vendor/client disclosure pack, not a scanner |
Query variable injection is Webhook::parse_request merging $_GET, not an ajax action=. HTTP is GET / with extra query keys.
GET/?page_id=4&shortcode_tags[blcpoc]=poc_witness_18937GET /?page_id=<front page id>&shortcode_tags[blcpoc]=poc_witness_18937Webhook::parse_request (plain permalinks) → $wp->query_vars += $_GETWP::register_globals → $GLOBALS['shortcode_tags']['blcpoc']=poc_witness_18937the_content('[blcpoc]') → poc_witness_18937() → POCWitness18937HTTP body contains POCWitness18937. Generic home HTML without that string is not it.
Do this first: Update Broken Link Checker to 2.4.12 or newer.
Verify after upgrade
CVE-2026-18937-Abraxas-Labs.py against the patched build: the mapped witness must not appear.If you cannot update immediately
Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.
python3 CVE-2026-18937-Abraxas-Labs.py
Success is the witness above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.
cd lab
docker compose up --force-recreate
Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.
# CVE-2026-18937 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-18937`
- CWE: CWE-94
- published: 2026-08-19T06:17:38.847
## NVD description
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
## MITRE description
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
## Affected
- Unknown Broken Link Checker 0 affected
## References (JSON sources only)
- https://wpscan.com/vulnerability/a23b76eb-107d-4e02-8eae-c3c5fa5b003d/
- https://github.com/advisories/GHSA-c2xc-88v3-37g2
- https://nvd.nist.gov/vuln/detail/CVE-2026-18937
- https://wpscan.com/vulnerability/a23b76eb-107d-4e02-8eae-c3c5fa5b003d
## GitHub advisory
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it...
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
This disclosure pack is licensed under the GNU Affero General Public License v3.0. See LICENSE.
This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.