WordPress Plugin Arbitrary Code Execution via Query Variable Injection

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Broken Link Checker WordPress plugin before version 2.4.12 contains a critical code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code on vulnerable servers. The flaw stems from insufficient validation of user-supplied query variables on sites configured with plain permalinks, enabling attackers to overwrite PHP global variables and achieve remote code execution when a classic WordPress editor is active. This vulnerability affects any WordPress installation using the vulnerable plugin version, regardless of authentication status, making it particularly dangerous for publicly accessible sites and a significant threat to data confidentiality, integrity, and availability.

Casky's 322 mapped security skills leverage Claude's extended reasoning to detect the attack patterns associated with TA0001 (Initial Access) and TA0043 (Reconnaissance) that precede exploitation. Practitioners using Casky would observe findings related to anomalous query parameter patterns in web server logs, particularly suspicious variable assignments targeting PHP superglobals like $_GET, $_POST, or $_GLOBALS through plain permalink URLs. The platform's skills would flag suspicious POST/GET requests to the plugin's vulnerable endpoints that contain PHP variable overwrite payloads, combined with evidence of subsequent code execution activities. Security teams would see correlated indicators: unusual query strings on sites with plain permalinks, potential PHP code in request parameters, and follow-on activities consistent with web shell deployment or data exfiltration—all mapped to the specific MITRE techniques used in reconnaissance and initial access chains.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18937.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-18937

Casky has 322 skills that investigate the attack patterns behind CVE-2026-18937. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn