Description

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-21T07:16:24.530Z",
  "pubdate": "2026-08-21T07:16:24.530Z",
  "executiveSummary": "An SQL injection vulnerability exists in the Link Whisper Free WordPress plugin prior to version 0.9.7.\nThe flaw stems from insufficient sanitization and escaping of a user-supplied parameter before it is incorporated directly into a database query.\nAuthenticated malicious actors possessing the Editor role or higher can exploit this vulnerability to execute arbitrary SQL commands against the underlying database.\nSuccessful exploitation compromises the confidentiality, integrity, and availability of the database, potentially exposing sensitive WordPress core tables, user credentials, and application data.\nPrerequisites for exploitation include administrative or editor-level authentication to the target WordPress instance, allowing privileged users to abuse authorized application functionality for malicious database interaction.",
  "technicalDetails": "The root cause of the vulnerability resides in the improper handling of input data within the Link Whisper Free plugin codebase prior to version 0.9.7.\nSpecifically, a parameter utilized in query construction fails to undergo rigorous input sanitization or proper contextual escaping before being concatenated or passed into a database query execution function.\nAuthentication and privilege requirements mandate that the requesting user holds an Editor role or higher within the WordPress content management system, constraining unauthenticated or low-privileged subscribers and contributors from direct exploitation.\nThe attack flow proceeds as follows: an authenticated attacker with sufficient privileges crafts a malicious HTTP request containing SQL payload syntax injected into the vulnerable parameter.\nUpon receiving the request, the Link Whisper Free plugin processes the input and integrates the tainted parameter directly into the SQL query string without adequate preparation via parameterized queries or prepared statements.\nThe database management system then parses and executes the malformed query alongside the injected SQL commands, returning unauthorized data sets or performing unintended database modifications depending on the constructed payload behavior.\nPost-exploitation impact includes unauthorized data exfiltration, enumeration of database schemas, reading sensitive data such as password hashes or user session tokens, and potential privilege escalation within the WordPress application environment."
}