Link Whisper Free: PHP Object Injection

Summary

Link Whisper Free, a WordPress plugin for internal linking, contains a PHP Object Injection flaw (CWE-502, deserialization of untrusted data) in versions up to and including 0.9.7. An attacker can send crafted data to the plugin to manipulate how the site processes objects, which can lead to harmful actions on the server. The CVSS 9.8 vector assumes no privileges and no user interaction, but Patchstack lists Contributor as the required privilege, so the exact preconditions are unclear.

Affected

• Link Whisper Free WordPress plugin, versions up to and including 0.9.7
• Vendor: Link Whisper INC

Fixed in

• Version 0.9.8 or later (per the CNA record and Patchstack)

Workaround

• No workaround documented. Patchstack reports a mitigation rule that blocks attacks until the plugin is updated, available with a Patchstack subscription.
• If updating is not possible, deactivate and remove the plugin.

Exploitation

• No known exploitation in the wild. CISA KEV: no.
• No public proof-of-concept found. VulDB states no exploit is available.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• EPSS about 0.3% for 30-day exploitation (secondary source).

Our recommendation

• Inventory all WordPress sites with Link Whisper Free and record their versions.
• Update to 0.9.8 or later, starting with internet-facing sites, after taking a backup.
• If updating is not possible, deactivate and remove the plugin or apply a virtual patch.
• Review logs for unusual POST or AJAX requests to the plugin.
• Verify the final fixed version and scoring in the Patchstack advisory and NVD, as the NVD status is Deferred.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OpenCVE CVE-2026-109686 app.opencve.io
• VulDB 420629 vuldb.com
• Strix CVE-2026-109686 www.strix.ai
• Shindan Link Whisper en.shindan.m-g-n.me
• WordPress.org Link Whisper plugin wordpress.org
• Websupport Link Whisper vulnerabilities websupportservices.co.uk
• Link Whisper update guide linkwhisper.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:51.