The Broken Link Checker plugin for WordPress by WPMU DEV contains a Blind SQL Injection vulnerability (CVE-2026-39466) due to improper neutralization of special elements in SQL commands. This affects all versions up to 2.4.7. Blind SQL Injection allows attackers to infer data from the database by sending crafted SQL queries that do not directly return data but can be used to extract information indirectly. The vulnerability is published but lacks a CVSS score and official remediation details. No known exploits have been reported. The plugin is not cloud-hosted, so patching depends on vendor updates.

Successful exploitation of this vulnerability could allow an attacker to perform blind SQL injection attacks against the affected plugin, potentially leading to unauthorized access to or manipulation of the WordPress site's database. This could compromise data confidentiality and integrity within the scope of the plugin's database interactions. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Broken Link Checker plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.