CVE-2026-109688: WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Link Whisper Freeto a version that resolves this vulnerability.Fixed in 0.9.8
Event History
Frequently Asked Questions
Which installations are affected?
Link Whisper Free versions through 0.9.7 are affected. The affected range begins at an unspecified earlier version, so deployments running 0.9.7 or older should be treated as potentially vulnerable.
Can this be exploited remotely without an account?
Yes. The vector is network-accessible, the attack complexity is low, and the CVSS vector indicates no privileges or user interaction are required.
What is the likely security impact?
The issue permits blind SQL injection and is rated critical with a 9.3 CVSS score. The supplied vector indicates high confidentiality impact, no integrity impact, and low availability impact, with scope changed.