CVE-2025-67962CWE-89

WordPress Broken Link Checker plugin <= 1.2.6 - SQL Injection vulnerability

High · published December 16, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
32.1
In the wild
Unconfirmed
What it is

⚡ Attention AIOSEO users! A sneaky SQL injection vulnerability simmering in the Broken Link Checker plugin could let an attacker manipulate your database with a simple input. 🔥 Think of this like a restaurant where anyone can walk in and reorder any dish just by changing the name on their ticket — it opens the door to chaos in the kitchen. That’s what SQL injection does to your database: it allows attackers to take control without a reservation! An attacker could exploit this vulnerability to view, modify, or even delete critical data from your database. Imagine them tossing out your customers' orders or altering menu prices at will — absolutely devastating!

Put simply

Think of this like a restaurant where anyone can walk in and reorder any dish just by changing the name on their ticket — it opens the door to chaos in the kitchen. That’s what SQL injection does to your database: it allows attackers to take control without a reservation! This SQL injection vulnerability in the AIOSEO plugin allows attackers to insert malicious SQL queries through improperly handled input, making it possible to manipulate the database behind the scenes.

What to do

An attacker could exploit this vulnerability to view, modify, or even delete critical data from your database. Imagine them tossing out your customers' orders or altering menu prices at will — absolutely devastating! Update the Broken Link Checker plugin to the latest version (1.2.7 or above) immediately to patch this vulnerability. Review any database queries in your code to ensure they are properly sanitized and use prepared statements. 🛡️ You've got this! Follow these steps, and you’ll be one step closer to securing your site! 🚀

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00392 · 32.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-16T08:12Z
EPSS history
Timeline
  • 16 DEC 08:12Z
    WordPress Broken Link Checker plugin <= 1.2.6 - SQL Injection vulnerability
    cvelistv5