CVE-2025-4047 MEDIUM

CVE-2025-4047: Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View

Vendor Wpmudev
Product Broken Link Checker
Weakness CWE-862 · Missing authorization
Published June 3, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The Broken Link Checker plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the ajax_full_status and ajax_dashboard_status functions in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view the plugin's status.

Explanation of Vulnerability in Simple Terms

02Summary

Broken Link Checker versions up to 2.4.4 fail to properly check user permissions before allowing access to certain functions. A logged-in user with low privileges can read sensitive information that should be restricted to administrators. The vulnerability requires an active user account but no special interaction from the victim.

What an attacker can do

03Attacker Capabilities

Read sensitive information restricted to site administrators.

Potential impact on your site

04Site Impact

Unauthorized users can access restricted data; review user accounts and update the plugin immediately.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site.

Key dates

06Disclosure timeline

June 3, 2025 CVE published
April 8, 2026 Record updated