CVE-2025-67962: 
WordPress vulnerability analysis and mitigation

CVE-2025-67962 is a SQL Injection vulnerability (CWE-89) in the AIOSEO Plugin Team's Broken Link Checker WordPress plugin (broken-link-checker-seo). It affects all versions up to and including 1.2.6, with version 1.2.7 containing the fix. The vulnerability was reported on November 9, 2025, published by Patchstack on December 9, 2025, and assigned a CVE on December 16, 2025. It carries a CVSS v3.1 base score of 7.6 (High), assigned by Patchstack (Patchstack, NVD).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is not properly sanitized before being incorporated into SQL queries within the plugin. Exploitation requires network access and high-level privileges (Author/Developer role), but the scope is changed, indicating the impact can extend beyond the vulnerable component itself. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) reflects a low-complexity, network-based attack requiring no user interaction. The vulnerability was discovered by researcher mcdruid and reported through Patchstack's responsible disclosure process (Patchstack).

Successful exploitation allows an authenticated attacker with Author-level or higher WordPress privileges to inject malicious SQL commands into the database, primarily resulting in high confidentiality impact — including potential theft of sensitive site data such as user credentials, personal information, and configuration details. Availability is marginally impacted (Low), while integrity is not directly affected according to the CVSS scoring. The changed scope indicates the impact may extend beyond the WordPress plugin itself to the underlying database server (Patchstack, NVD).

There is no public evidence of active in-the-wild exploitation or weaponized exploit code as of the available data. The EPSS score is very low at approximately 0.021%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is "unlikely to be exploited," though it acknowledges that SQL injection vulnerabilities can be used in mass-exploit campaigns targeting WordPress sites (Patchstack).

The primary remediation is to update the Broken Link Checker plugin (broken-link-checker-seo) to version 1.2.7 or later, which contains the patch for this vulnerability. Patchstack users can enable auto-update for vulnerable plugins to automate this process. If an immediate update is not possible, site administrators should restrict Author-level and above user accounts to trusted individuals only, as exploitation requires high privileges. Consulting a hosting provider or web developer for assistance is recommended if self-remediation is not feasible (Patchstack).

Wordfence included this vulnerability in its weekly WordPress vulnerability report covering December 8–14, 2025, and Sucuri referenced it in its December 2025 vulnerability patch roundup, indicating routine coverage within the WordPress security community. No significant vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified.