{"id":"CVE-2026-109688","published":"2026-10-15T13:17:11.917","lastModified":"2026-10-15T15:17:27.873","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/link-whisper/vulnerability/wordpress-link-whisper-free-plugin-0-9-7-sql-injection-vulnerability-2?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to perform blind SQL injection attacks against the Link Whisper Free plugin, potentially leading to unauthorized data access and manipulation. The flaw occurs due to improper neutralization of special elements in SQL commands.","exploitability":"Exploitation is relatively straightforward as it's a blind SQL injection vulnerability that can be leveraged without authentication, requiring only network access to the affected WordPress site.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive data from the database, potentially including user credentials, configuration details, and other valuable information stored in the WordPress installation.","remediation":"Upgrade to version 0.9.8 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","blind-injection"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:48:01.269Z"}}