Prettylinks Affiliate Link Management Url Shortener Link Cloaking Tracking Branded Short Links
Monthly
SQL injection in the PrettyLinks WordPress plugin (all versions through 3.6.20) enables authenticated administrators to extract arbitrary data from the underlying WordPress database by appending malicious SQL to the 's' search parameter on the Pretty Links listing page. The root cause is insufficient input escaping and absent prepared-statement usage in the `search_links_table()` function within `PrliLinksController.php`. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS confidentiality impact is rated High, meaning successful exploitation could expose all data stored in the WordPress database.
SQL injection in the PrettyLinks WordPress plugin (all versions through 3.6.20) enables authenticated administrators to extract arbitrary data from the underlying WordPress database by appending malicious SQL to the 's' search parameter on the Pretty Links listing page. The root cause is insufficient input escaping and absent prepared-statement usage in the `search_links_table()` function within `PrliLinksController.php`. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS confidentiality impact is rated High, meaning successful exploitation could expose all data stored in the WordPress database.