CVE-2026-84772: CWE-918 Server-Side Request Forgery (SSRF) in WPMU DEV Broken Link Checker

This vulnerability, identified as CWE-918 (Server-Side Request Forgery), exists in the Broken Link Checker plugin by WPMU DEV, affecting versions up to 2.4.14. It allows an attacker with high privileges to cause the server to send crafted requests to internal or external systems, potentially exposing sensitive information or altering data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with limited confidentiality and integrity impacts but no availability impact. The vulnerability is published but lacks an official remediation or patch at this time.

An attacker with high privileges can exploit this SSRF vulnerability to make the server perform unintended requests, which may lead to limited disclosure of sensitive information and limited modification of data. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and limit high-privilege user accounts to trusted personnel only to reduce the risk of exploitation.