Link Whisper Free CVE-2026-109688

The target site must run the Link Whisper Free plugin at version 0.9.7 or earlier. Exploitation requires reaching the specific (undisclosed in the provided data) plugin request handler that builds a SQL query from attacker-controlled input; the description does not identify the parameter or feature, so the precise trigger is unconfirmed. The supplied CVSS vector asserts PR:N/UI:N (no authentication or user interaction), but because the privileged role is not documented and Patchstack frequently rates such plugin flaws as requiring a low-privilege authenticated account (e.g., contributor/author), the true limiting factor may be authenticated access - verify with the Patchstack advisory before assuming pre-auth reachability. Being blind, exploitation also depends on the attacker being able to observe response or timing differences.

Signals are mixed and partially unverified. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, 9.3 Critical) describes a network-reachable, low-complexity, unauthenticated blind SQL injection - a theoretically high-priority profile. However, this is Patchstack-scored, and Patchstack commonly assigns PR:N to WordPress plugin flaws that in practice require some authenticated role; the one-line description does not name the vulnerable endpoint, parameter, or required privilege level, so the PR:N / unauthenticated claim cannot be independently confirmed from the data provided. No EPSS score, no CISA KEV listing, and no public exploit (POC) are present in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. The scope-change (S:C) with C:H but I:N/A:N is an unusual Patchstack convention rather than a classic SQLi impact profile. Net assessment: a genuinely serious injection class (CWE-89) in a moderately deployed WordPress plugin, but real-world urgency is tempered by the absence of exploitation signals and the single-source, low-detail reporting. Treat as a patch-soon item for sites running Link Whisper Free, not an emergency on exploitation-evidence grounds.

An attacker sends crafted input to the vulnerable Link Whisper Free request parameter, injecting boolean- or time-based blind SQL conditions that the plugin passes unsanitized into a database query. By observing differential responses or timing, the attacker iteratively extracts WordPress database contents such as user records and password hashes. No public exploit code is identified at time of analysis, and the exact privilege level needed to reach the vulnerable endpoint is not confirmed by the available data.