CVE-2025-6851
📋 TL;DR
The Broken Link Notifier WordPress plugin contains a Server-Side Request Forgery (SSRF) vulnerability that allows unauthenticated attackers to make arbitrary web requests from the vulnerable server. This can be used to query internal services, potentially exposing sensitive information or enabling further attacks. All WordPress sites using this plugin version 1.3.0 or earlier are affected.
💻 Affected Systems
- WordPress Broken Link Notifier plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, steal sensitive data, pivot to internal networks, or perform port scanning of internal infrastructure.
Likely Case
Information disclosure from internal services, reconnaissance of internal network structure, or abuse of the server as a proxy for malicious requests.
If Mitigated
Limited to information gathering about internal services if proper network segmentation and egress filtering are in place.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited. The unauthenticated nature makes this particularly dangerous.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 1.3.0
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Broken Link Notifier. 4. Click 'Update Now' if available. 5. If no update available, deactivate and delete the plugin.
🔧 Temporary Workarounds
Deactivate Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate broken-link-notifier
Restrict Network Access
allImplement egress filtering to limit outbound requests from web server
🧯 If You Can't Patch
- Deactivate and remove the Broken Link Notifier plugin immediately
- Implement web application firewall rules to block requests to the vulnerable ajax_blinks() endpoint
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Broken Link Notifier version. If version is 1.3.0 or earlier, you are vulnerable.Check Version:
wp plugin list --name=broken-link-notifier --field=versionVerify Fix Applied:
Verify plugin version is greater than 1.3.0. Test the ajax_blinks() endpoint with SSRF payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from web server to internal IPs
- Requests to /wp-admin/admin-ajax.php with action=blinks parameter
- Multiple failed requests to internal services
Network Indicators:
- Web server making requests to internal IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x)
- Unusual traffic patterns from web server to non-standard ports
SIEM Query:
source="web_server_logs" AND (uri="/wp-admin/admin-ajax.php" AND parameters CONTAINS "action=blinks")