CVE-2025-11734: 
WordPress vulnerability analysis and mitigation

CVE-2025-11734 is a missing authorization vulnerability in the "Broken Link Checker by AIOSEO" WordPress plugin that allows authenticated attackers with contributor-level access to trash arbitrary posts. The flaw affects all versions up to and including 1.2.5 of the plugin. It was published on November 18, 2025, and assigned a CVSS v3.1 base score of 5.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the plugin registers a REST API endpoint (DELETE /wp-json/aioseoBrokenLinkChecker/v1/post) that only validates whether the requesting user holds the broad aioseo_blc_broken_links_page capability — a capability granted to contributor-level users — without performing any object-level authorization check to confirm the user has permission to modify the specific post being targeted. This broken access control allows any authenticated contributor (or higher) to send a crafted DELETE request targeting any post ID on the site, causing it to be moved to the trash regardless of post ownership (Wordfence, ENISA EUVD).

Successful exploitation allows an authenticated attacker with minimal privileges (contributor role) to trash any post on the WordPress site, including posts authored by administrators or editors, resulting in loss of content availability and potential disruption of site operations. There is no confidentiality impact, but integrity and availability are both affected at a low severity level. While lateral movement is not directly enabled, content destruction could be used as a disruptive action or to cover tracks in a broader attack scenario (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires authentication (contributor-level account or above), which limits opportunistic exploitation but makes it relevant in multi-author WordPress environments. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Wordfence, ENISA EUVD).

1. Obtain contributor-level access: Register or compromise a contributor account on the target WordPress site running the vulnerable Broken Link Checker by AIOSEO plugin (version ≤ 1.2.5).
2. Authenticate and retrieve a nonce/session: Log in to the WordPress site and obtain a valid authentication cookie or REST API nonce to authorize API requests.
3. Identify target post IDs: Browse the site or use the WordPress REST API (GET /wp-json/wp/v2/posts) to enumerate post IDs belonging to other users (e.g., administrators).
4. Send malicious DELETE request: Issue a DELETE request to the vulnerable endpoint, specifying the target post ID:

   DELETE /wp-json/aioseoBrokenLinkChecker/v1/post?postId=<TARGET_POST_ID>
   Authorization: <contributor session cookie or nonce>

5. Confirm post trashed: Verify that the targeted post has been moved to the WordPress trash, effectively removing it from public view without the post owner's consent (Wordfence).

• Network: Unusual DELETE requests to /wp-json/aioseoBrokenLinkChecker/v1/post in web server access logs, especially from contributor-level user sessions or at high frequency.
• Logs: WordPress debug or access logs showing repeated DELETE API calls to the AIOSEO Broken Link Checker endpoint with varying postId parameters from a single authenticated user.
• Application: Unexpected posts appearing in the WordPress trash (wp-admin > Posts > Trash) that were not deleted by their authors or administrators; posts from multiple authors trashed in a short time window.
• User Activity: Contributor-level accounts making REST API calls outside of normal editorial activity, particularly DELETE method requests (Wordfence).

Update the Broken Link Checker by AIOSEO plugin to version 1.2.6 or later, which addresses the missing authorization check by implementing proper object-level permission verification on the DELETE endpoint. The fix is available via the WordPress plugin repository changeset (WordPress Trac). As a temporary workaround, site administrators can restrict contributor-level registrations or disable the plugin until the patch is applied. Reviewing and auditing the WordPress trash for unexpectedly deleted posts is also recommended (Wordfence).

Sucuri included CVE-2025-11734 in their November 2025 vulnerability patch roundup, highlighting it as part of a broader set of WordPress plugin issues requiring attention (Sucuri Blog). No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability aggregator coverage.