Is CVE-2026-102389 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102389 being exploited in the wild.

How severe is CVE-2026-102389?

Medium severity, with a CVSS score of 6.5, published 15 October 2026.

Which products and versions are affected?

WPMU DEV Broken Link Checker through 2.4.14.1.

Is there a fix for CVE-2026-102389?

Yes: fixed in 2.4.15. Until then: Update the plugin to version 2.4.15 or later immediately. If you are unable to update directly, enable Patchstack's mitigation rule to block attacks until patching is completed. [{"kind":"disclosed","at":"2026-10-15"},{"kind":"patched","at":"2026-10-15","note":"Version 2.4.15 released"},{"kind":"other","at":"2026-09-24","note":"Vulnerability reported by changsheng"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102389 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-102389?

Check whether you run WPMU DEV Broken Link Checker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102389: WPMU DEV Broken Link Checker code injection vulnerability

CVE-2026-102389 · Severity: medium · CVSS 6.5 · Published 2026-10-15

WPMU DEV's Broken Link Checker is a WordPress plugin that identifies and manages broken hyperlinks on websites. A code injection vulnerability in versions up to 2.4.14.1 allows attackers to inject malicious content or code into pages, potentially exposing site visitors to ads, scams, or malware. The vulnerability requires user interaction but can be exploited by unauthenticated attackers to compromise site integrity.

Technologies: WPMU DEV Broken Link Checker. Vendors: WPMU DEV.

Quick answers

Is CVE-2026-102389 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102389 being exploited in the wild.
How severe is CVE-2026-102389?: Medium severity, with a CVSS score of 6.5, published 15 October 2026.
Which products and versions are affected?: WPMU DEV Broken Link Checker through 2.4.14.1.
Is there a fix for CVE-2026-102389?: Yes: fixed in 2.4.15. Until then: Update the plugin to version 2.4.15 or later immediately. If you are unable to update directly, enable Patchstack's mitigation rule to block attacks until patching is completed.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-15"},{"kind":"patched","at":"2026-10-15","note":"Version 2.4.15 released"},{"kind":"other","at":"2026-09-24","note":"Vulnerability reported by changsheng"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102389 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-102389?: Check whether you run WPMU DEV Broken Link Checker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.4.15

Update the plugin to version 2.4.15 or later immediately. If you are unable to update directly, enable Patchstack's mitigation rule to block attacks until patching is completed.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-15"},{"kind":"patched","at":"2026-10-15","note":"Version 2.4.15 released"},{"kind":"other","at":"2026-09-24","note":"Vulnerability reported by changsheng"}]

Technical details

The vulnerability is a code injection flaw in the Broken Link Checker WordPress plugin affecting versions through 2.4.14.1. It allows unauthenticated attackers to inject arbitrary code or content, though successful exploitation requires a privileged user to perform an action such as clicking a malicious link or visiting a crafted page. The attack vector is network-based and classified as content injection rather than arbitrary code execution.

Affected products

WPMU DEV Broken Link Checker through 2.4.14.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.