Link Whisper Free CVE-2026-109687

Exploitation requires an authenticated session with high privileges (PR:H per the CVSS vector) on a WordPress site running Link Whisper Free version 0.9.7 or earlier; the plugin must be installed and active. No user interaction by a victim is needed (UI:N) and the attack is reachable over the network (AV:N), but the high-privilege authentication requirement is the primary limiting factor - this is not remotely exploitable by anonymous users. The exact vulnerable feature/parameter is not named in the advisory data provided, which limits precise pre-condition identification.

This is a moderate-priority issue rather than an urgent one. The CVSS 3.1 base score of 7.6 is driven largely by the scope-change flag (S:C) and network attack vector (AV:N/AC:L), but the vector also specifies PR:H - meaning a high-privilege, authenticated account is required, which substantially narrows the real-world attacker pool for a WordPress plugin. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (blind SQLi mapped to CWE-89, C:H/I:N/A:L reflecting data disclosure with limited integrity/availability effect), but the S:C (scope changed) assertion is questionable for an in-application SQL injection and should be treated with caution - Patchstack-sourced WordPress vectors frequently mark S:C where a conventional same-security-authority SQLi would be S:U, which would lower the score. Because PR:H gates the flaw behind an already-privileged user, realistic risk is best described as insider/compromised-credential data exposure rather than mass remote exploitation. Note the SSVC framework inputs (exploitation status, automatable, technical impact) were not provided, so an SSVC decision cannot be rendered from this data.

An authenticated high-privilege user (or an attacker who has obtained such credentials via phishing or reuse) submits crafted input to a vulnerable plugin parameter that is concatenated into a SQL query. Because the injection is blind, the attacker infers database contents through boolean or time-based responses, progressively extracting sensitive data such as user records or secrets from the WordPress database. No public POC is identified in the provided data, so exploitation would require manual development against the 0.9.7-and-earlier codebase.