CVE-2025-1264 – This SQL injection vulnerability in the Broken ... (How to Fix)

📋 TL;DR

This SQL injection vulnerability in the Broken Link Checker WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject malicious SQL queries via the 'orderBy' parameter. This can lead to unauthorized data extraction from the WordPress database, affecting all sites running vulnerable plugin versions.

💻 Affected Systems

Products:

Broken Link Checker by AIOSEO WordPress plugin

Versions: All versions up to and including 1.2.3

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user with Contributor role or higher. WordPress multisite installations are also affected.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could extract sensitive data including user credentials, personal information, or administrative data, potentially leading to complete site compromise.

🟠

Likely Case

Data exfiltration from the WordPress database, potentially exposing user information, plugin settings, or other stored data.

🟢

If Mitigated

Limited impact if proper access controls and network segmentation are in place, restricting database access.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but uses common SQL injection techniques. The vulnerability is in API endpoints accessible to authenticated users.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.2.4 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3263416%40broken-link-checker-seo&new=3263416%40broken-link-checker-seo&sfp_email=&sfph_mail=

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Broken Link Checker by AIOSEO'
4. Click 'Update Now' if available
5. Alternatively, download version 1.2.4+ from WordPress.org and manually update

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the Broken Link Checker plugin until patched

wp plugin deactivate broken-link-checker-seo

Restrict user roles

all

Temporarily remove Contributor and higher roles from untrusted users

🧯 If You Can't Patch

Implement web application firewall (WAF) rules to block SQL injection patterns
Apply principle of least privilege: restrict database user permissions to only necessary operations

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for Broken Link Checker version. If version is 1.2.3 or lower, you are vulnerable.

Check Version:

wp plugin get broken-link-checker-seo --field=version

Verify Fix Applied:

After updating, verify plugin version shows 1.2.4 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in WordPress debug logs
Multiple failed authentication attempts followed by successful Contributor login
Unusual database queries from WordPress application user

Network Indicators:

Unusual outbound database connections from web server
Large data transfers from web server to external IPs

SIEM Query:

source="wordpress.log" AND ("orderBy" OR "broken-link-checker") AND (sql OR union OR select)

📊 Metadata

CVE ID: CVE-2025-1264

CVSS v3 Score: 6.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-89

EPSS Score: 0.21% exploit probability (43.4th percentile)

Published: April 6, 2025

Last Updated: April 7, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-1264, you might also want to check these: