Critical SQL Injection Flaw Found in Link Whisper Free Plugin Versions Up to 0.9.7
A severe vulnerability in the Link Whisper Free WordPress plugin allows blind SQL injection, posing a critical risk to sites running versions through 0.9.7.
Key points
- CVE-2026-109688 is rated Critical with a CVSS score of 9.3.
- The flaw involves improper neutralization of special elements in SQL commands.
- All versions of Link Whisper Free up to and including 0.9.7 are affected.
A critical security vulnerability has been identified in the Link Whisper Free WordPress plugin, affecting all versions up to 0.9.7. The flaw, assigned CVE-2026-109688, allows for blind SQL injection attacks, potentially exposing sensitive database information to unauthorized access.
At a glance
- CVE
- CVE-2026-109688
- Product
- Link Whisper Free
- CVSS
- 9.3 Critical
- Weakness
- SQL injection
- Exploited
- No known exploitation
The vulnerability stems from improper neutralization of special elements used in SQL commands, classified under CWE-89. This weakness enables attackers to manipulate database queries through user input. The National Vulnerability Database rates the issue as Critical, assigning it a CVSS score of 9.3.
Context and Background
SQL injection remains one of the most dangerous web application vulnerabilities. It occurs when an application fails to properly sanitize user input before including it in a database query. Attackers can exploit this to execute arbitrary SQL commands, potentially reading, modifying, or deleting data.
Blind SQL injection is a specific variant where the attacker does not receive direct feedback from the database. Instead, they infer information based on the application’s behavior or response times. This technique can be difficult to detect but remains highly effective for extracting data.
Who Is Affected
The issue impacts Link Whisper Free, a plugin developed by Link Whisper INC. According to the NVD record, the vulnerability affects versions from the initial release through 0.9.7. Site administrators using any of these versions are exposed to potential exploitation.
Link Whisper is designed to help users manage internal links within their content. While the free version is popular, the security flaw compromises the integrity of the underlying database. Users must verify their installed version to determine if they are at risk.
What should you do?
Site owners should immediately check their WordPress dashboard for the Link Whisper Free plugin version. If the installed version is 0.9.7 or lower, the site is vulnerable. Administrators should monitor for unusual database activity or unauthorized access attempts while awaiting a vendor update.
What to do and how to stay safe: Link Whisper Free
- Verify the installed version of Link Whisper Free in your WordPress plugin list.
- Restrict database access to trusted IP addresses to limit exposure.
- Enable detailed logging to detect suspicious SQL query patterns.
- Wait for an official update from Link Whisper INC before applying unofficial patches.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The vulnerability is identified as CVE-2026-109688.
Which versions of Link Whisper Free are affected?
All versions from the initial release through 0.9.7 are affected.
What type of vulnerability is this?
It is a blind SQL injection vulnerability caused by improper neutralization of special elements.
