EUVD-2026-63816
GHSA-xvc3-c736-hqp5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
PR:H for required Editor role; S:C and C:H for full-database read via SQL injection; I:L added because CWE-89 inherently enables stacked-query writes, not confirmed absent.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.
AnalysisAI
SQL injection in the Link Whisper Free WordPress plugin (all versions before 0.9.7) enables authenticated users holding the Editor role or above to execute arbitrary SQL queries against the underlying WordPress database, with potential scope change to data beyond the plugin's own tables. Reported by WPScan with a publicly available proof-of-concept, this raises the practical exploitability despite the elevated privilege requirement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum the Editor role - Subscriber and Contributor roles are insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS score of 6.8 (Medium) reflects the PR:H constraint (Editor role required), which is a real-world barrier that meaningfully limits the attack surface compared to unauthenticated or subscriber-level flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Link Whisper Free plugin to version 0.9.7 or later immediately via the WordPress admin dashboard (Plugins > Installed Plugins > Update) or the WordPress.org plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Link Whisper Free
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link
Stored cross-site scripting in the Link Whisper Free WordPress plugin (versions through 0.9.0) allows unauthenticated re
Reflected cross-site scripting in the Link Whisper Free WordPress plugin (versions 0.9.4 and earlier) lets an unauthenti
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today