CVE-2025-6851

HIGHNuclei

Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-6851 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jul 10, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 11, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Broken Link Notifier plugin for WordPress

Browse PluginRx / Broken Link Notifier plugin for WordPress
VulnCheckVersion data not supplied

Broken Link Notifier

Browse apos37 / Broken Link Notifier

Default status: unaffected

CVE ListThrough 1.3.0affected

Nuclei templates

1
ProjectDiscoveryHIGHWordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRFCVSS 7.5

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Impact

An attacker can exploit this vulnerability to perform server-side request forgery attacks, potentially accessing internal services, reading local files, or conducting port scanning from the server's perspective.

Remediation

Update the Broken Link Notifier plugin to version 1.3.1 or later which fixes this vulnerability. If immediate update is not possible, consider temporarily disabling the plugin until the fix can be applied.

WeaknessesCWE-918
Authorsiamnoooob, pdresearch
Template tagscvecve2025wp-pluginwordpressssrfoastunauthwpscanbroken-link-notifiervkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:broken_link_notifier_project:broken_link_notifier:*:*:*:*:*:wordpress:*:*
FOFA: body="blnotifier_front_end"
https://nvd.nist.gov/vuln/detail/CVE-2025-6851 https://wpscan.com/vulnerability/CVE-2025-6851 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/broken-link-notifier/broken-link-notifier-130-unauthenticated-server-side-request-forgery

Source: ProjectDiscovery

References

3