Link Whisper Free: Blind SQL injection in WordPress plugin
Summary
Link Whisper Free, a WordPress plugin for internal linking, contains a blind SQL injection flaw in versions up to and including 0.9.7. According to the CNA vector, no privileges are required, so an unauthenticated attacker on an internet-facing site could extract database content such as user accounts and private data over time. The CVSS score is 9.3 (Critical) per the CNA; NVD analysis is still pending and other trackers list lower scores. No public proof of concept and no evidence of active exploitation were found at the time of research.
Affected
- Link Whisper Free plugin for WordPress, versions through 0.9.7
- Vendor: Link Whisper INC (plugin author listed as Spencer Haws)
- Pro/premium versions: not assessed
Fixed in
- Version 0.9.8 or later (per the WordPress.org listing; no vendor advisory or changelog entry naming this CVE was found)
Workaround
- No vendor workaround found.
- If updating is delayed, deactivate the plugin if it is not essential.
- Restrict or review accounts with editor-level access.
- Consider WAF rules (general recommendation, not vendor guidance).
Exploitation
- Exploitation in the wild: no evidence found; not listed in CISA KEV.
- CISA SSVC: Exploitation none, automatable yes.
- Public PoC: none found (VulDB: no exploit available).
- EPSS: 0.00236 according to one aggregator (low short-term probability).
Our recommendation
- Inventory WordPress sites with Link Whisper Free and check the installed version.
- Update to version 0.9.8 or later, or deactivate the plugin until updated.
- Review admin and editor accounts, enforce strong passwords and MFA.
- Check web server and database logs for unusual requests to the plugin and signs of data extraction.
- Monitor the Patchstack and vendor pages for the advisory and any PoC.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OpenCVE CVE-2026-109688 app.opencve.io
- INCIBE-CERT alert www.incibe.es
- WordPress.org plugin listing (Link Whisper) wordpress.org
- VulDB entry 420630 vuldb.com
- Offseq threat radar radar.offseq.com
- Threatint CVE record cve.threatint.com
- Vulners CNNVD record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:40.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.