VulnSocial

CVE-2026-18937Exploit

MEDIUMCVSS 9.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-09-19); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-19: 1Mentions · 2026-10-22: 1PoC Mentioned / Linked · 2026-09-19: 1Exploit Tool / Code · 2026-09-19: 1Patch / Workaround · 2026-10-22: 1Technical Details · 2026-09-19: 1Technical Details · 2026-10-22: 109-1910-22
Signal classification2 categories
Exploit
150.0%
Patch
150.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-191
Exploit1
2026-10-221
Patch1
Full discourse2 posts
  • pdnuclei-bot@pdnuclei_bot
    Patch

    🚨 CVE-2026-18937 - critical 🚨 WordPress Broken Link Checker < 2.4.12 - Remote Code Execution > The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query var... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-18937 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet announces CVE-2026-18937 as a critical RCE in WordPress Broken Link Checker, references the fixed version 2.4.12, and links to Nuclei scanning templates, with no exploit code or active exploitation claims.

    01022220
    1.4K followersView on X
  • abraxas@abraxas_null
    Exploit

    CVE-2026-18937 - Broken Link Checker (WPMU DEV) (CRITICAL 9.0) - Unauth RCE. Sorry @_WPScan_ , i broke your embargo. im more of a laissez-faire kinda guy. exploit: https://github.com/abraxas/CVE-2026-18937 lab writeup (with infra): https://abraxaslabs.tech/research/cve-2026-18937

    Post summary

    The tweet publicly discloses CVE-2026-18937, a critical unauthenticated RCE in the Broken Link Checker plugin, and releases functional exploit code on GitHub, explicitly breaking an embargo.

    00010113
    129 followersView on X

Explore more

Back to dashboard