Description
WordPress Broken Link Notifier插件是一款用于检测和通知网站中失效链接的工具。该插件在ajax_blinks()函数中未对用户提供的URL进行充分验证，导致存在服务器端请求伪造漏洞。攻击者可通过构造恶意请求，使服务器向任意内部或外部地址发起HTTP请求，从而探测内网服务、获取敏感信息或进行未授权操作。
WordPress Broken Link Notifier /wp-admin/admin-ajax.php blnotifier_blinks 服务器端请求伪造漏洞（CVE-2025-6851）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-6851
https://github.com/advisories/GHSA-x4vc-m5g5-663m
https://wpscan.com/vulnerability/bb4413cf-75dc-4cb5-9261-980f331fd33f/
https://cert.kenet.or.ke/cve-2025-6851-wordpress-broken-link-notifier-ssrf
https://www.wordfence.com/threat-intel/vulnerabilities/id/0f76c9f8-c57a-4875-b581-f67c9c60021c
https://patchstack.com/database/Wordpress/Plugin/broken-link-notifier/vulnerability/wordpress-broken-link-notifier-plugin-1-3-4-broken-access-control-vulnerability
https://cve.imfht.com/detail/CVE-2025-6851
https://really-simple-ssl.com/vulnerability/19aecf4d-3f4b-40db-92c4-fc38f92eb0c7/