CVE-2026-109686: WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/link-whisperto a version that resolves this vulnerability.Fixed in 0.9.8
Event History
Frequently Asked Questions
Which versions are affected?
Link Whisper Free versions through 0.9.7 are affected. The available information does not identify a fixed version.
Can this be exploited remotely without authentication or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the potential impact?
The reported CVSS metrics indicate high impact to confidentiality, integrity, and availability. Successful exploitation involves PHP object injection through deserialization of untrusted data.