CVE-2026-96562: CWE-94 Improper Control of Generation of Code ('Code Injection') in wpmudev Broken Link Checker

CVE-2026-96562 is a code injection vulnerability (CWE-94) in the Broken Link Checker plugin for WordPress, affecting all versions up to and including 2.4.14.1. The flaw arises from improper validation of user-supplied input before executing shortcodes via do_shortcode. An attacker can submit a comment containing a malicious shortcode payload in an href or src attribute. If the comment is approved through normal moderation, the shortcode executes automatically via WP-Cron without further attacker interaction, enabling arbitrary shortcode execution.

An unauthenticated attacker can achieve arbitrary shortcode execution, potentially leading to limited confidentiality and integrity impacts on the affected WordPress site. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality and integrity impact with no availability impact.

No explicit patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should carefully moderate comments to prevent approval of malicious shortcode payloads and consider disabling or restricting the Broken Link Checker plugin if possible.