CVE-2026-109688
9.3 CRITICALPublished 2026-10-15 · Updated 2026-10-15
AI risk analysis
- Summary
- This vulnerability allows attackers to perform blind SQL injection attacks against the Link Whisper Free plugin, potentially leading to unauthorized data access and manipulation. The flaw occurs due to improper neutralization of special elements in SQL commands.
- Exploitability
- Exploitation is relatively straightforward as it's a blind SQL injection vulnerability that can be leveraged without authentication, requiring only network access to the affected WordPress site.
- Blast radius
- If exploited, this vulnerability could allow attackers to extract sensitive data from the database, potentially including user credentials, configuration details, and other valuable information stored in the WordPress installation.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 0.9.8 or later to remediate this SQL injection vulnerability.
sql-injectionwordpressblind-injection
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Weaknesses
CWE-89
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2022-4997
- HIGHCVE-2026-103695
- HIGHCVE-2026-103913
- HIGHCVE-2026-104408
- CRITICALCVE-2026-109698
- MEDIUMCVE-2026-14872
- CRITICALCVE-2026-15360
- HIGHCVE-2026-15918
Related by shared AI tags and CWE weakness class. Browse the full archive.