CVE-2026-109687: WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Link Whisper Freeto a version that resolves this vulnerability.Fixed in 0.9.8
Event History
Frequently Asked Questions
Who can exploit this issue?
The vector is network-accessible and exploitation requires high privileges. No user interaction is required.
Are installations running version 0.9.7 affected?
Yes. The affected range includes Link Whisper Free through version 0.9.7; no lower bound is specified.
What is the potential impact of successful exploitation?
The issue is a blind SQL injection vulnerability. The supplied severity vector indicates high confidentiality impact, no integrity impact, and low availability impact, with scope changed.