CVE-2026-87767: WP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via url

Q: Who can exploit this issue?

The affected AJAX action is available to unauthenticated users, so an attacker does not need a WordPress account or prior authentication to attempt exploitation.

Q: What attacker capability does successful exploitation provide?

An attacker can perform SQL injection through the url parameter and may extract sensitive data from the WordPress database.

Q: Which versions are affected?

The plugin is affected through version 1.2.0. The provided information does not identify a fixed version.

Published Sep 18, 2026

Updated

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.

Affected Software

1 affected component

WordPress plugin "WP Shortcut Link"<=1.2.0

Event History

Sep 18, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

The affected AJAX action is available to unauthenticated users, so an attacker does not need a WordPress account or prior authentication to attempt exploitation.

What attacker capability does successful exploitation provide?

An attacker can perform SQL injection through the url parameter and may extract sensitive data from the WordPress database.

Which versions are affected?

The plugin is affected through version 1.2.0. The provided information does not identify a fixed version.