CVE-2022-2438

The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.

• CWE-502
• CWE-502
• CWE-502

• https://plugins.trac.wordpress.org/changeset/2757773/broken-link-checker/trunk/core/core.php?old=2605914&old_path=broken-link-checker%2Ftrunk%2Fcore%2Fcore.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/62fd472e-208b-48db-8f98-3d935c7a678c?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2438Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2757773/broken-link-checker/trunk/core/core.php?old=2605914&old_path=broken-link-checker%2Ftrunk%2Fcore%2Fcore.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/62fd472e-208b-48db-8f98-3d935c7a678c?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2438Third Party Advisory

Published

Sep 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24374Cross-site scripting vulnerability in a-blog cms Ver.2.8.x s…6.1
• CVE-2022-24375The package node-opcua before 2.74.0 are vulnerable to Denia…7.5
• CVE-2022-24376All versions of package git-promise are vulnerable to Comman…9.8
• CVE-2022-24377The package cycle-import-check before 1.3.2 are vulnerable t…9.8
• CVE-2022-24378Improper initialization in the Intel(R) Data Center Manager …5.5
• CVE-2022-24379Improper input validation in some Intel(R) Server System M70…6.7
• CVE-2022-24380Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2022-24381All versions of package asneg/opcuastack are vulnerable to D…7.5
• CVE-2022-24382Improper input validation in firmware for some Intel(R) NUCs…6.7
• CVE-2022-24383The affected product is vulnerable to an out-of-bounds read,…7.8
• CVE-2022-24384Cross-site Scripting (XSS) vulnerability in SmarterTools Sma…6.1
• CVE-2022-24385A Direct Object Access vulnerability in SmarterTools Smarter…6.5