External risk intelligence

Link Whisper Free SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-109688

Link Whisper is a WordPress plugin used for internal linking. WordPress sites are frequently deployed as public-facing web applications. Since the plugin operates within the web-accessible context of a CMS to process requests, it is commonly exposed to the internet, making it a likely target for remote interaction.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A SQL injection vulnerability has been identified in the Link Whisper Free plugin for WordPress. This flaw could allow unauthorized access to data within affected systems, as it enables attackers to manipulate database queries. The main concern is confirming if your organization uses this specific plugin and is therefore exposed.

Flaw lets attackers inject malicious SQL commands.
Important to check for this specific plugin's use.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a vulnerable Link Whisper Free installation. This could lead to a blind SQL injection, allowing them to manipulate database queries and potentially gain unauthorized access to sensitive information or disrupt application functionality.

No special access required.
Triggered by unauthenticated HTTP requests.
Risks unauthorized data access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject malicious SQL commands when supported by the advisory, potentially leading to the disclosure of sensitive database information. When the advisory conditions are met, this could impact the integrity and confidentiality of data stored within the affected system.

Sensitive database information.
Exploiting unauthenticated API endpoints.
Unauthorized data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Link Whisper Free impacts WordPress sites, making application owners and potentially infrastructure or platform teams responsible for its remediation. The first practical step is to identify all instances of Link Whisper Free, determine their exposure and business criticality, and then ascertain the accountable owner for each instance to plan remediation efforts based on risk.

Application owners should investigate usage.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Link Whisper Free plugin used for?

Link Whisper Free is a WordPress plugin designed to automate and simplify internal linking across a website. By analyzing site content, it suggests relevant links between pages to help improve site navigation and search engine optimization. Because it is a CMS plugin, it runs directly within your WordPress environment to process page data and manage link structures dynamically.

What does SQL injection mean in CVE-2026-109688?

This vulnerability is classified as CWE-89, which refers to the improper neutralization of special elements in a database query. In simple terms, the plugin fails to properly filter inputs, allowing an attacker to inject their own malicious SQL commands into the application's database queries. This can result in a 'blind' injection, where the attacker extracts information by observing how the application responds to different, specifically crafted queries.

How is the vulnerability triggered?

An attacker triggers this flaw by sending specially crafted HTTP requests to the vulnerable plugin. This process does not require any prior authentication or special user privileges on the WordPress site. Simply browsing the site or interacting with exposed endpoints is not enough to trigger the bug; the requests must be specifically malformed to successfully manipulate the underlying database query.

Is my site at risk if I use Link Whisper Free?

According to Halo Surface Signal, this plugin is likely to be exposed because it operates within a WordPress CMS, which is typically deployed as a public-facing web application. Since the plugin processes network-based requests, any instance accessible from the internet is considered a likely target for remote interaction. You should care if your site is internet-facing, as it presents a broader attack surface than an internal, restricted-access site.

What should I do if I run Link Whisper Free?

Your first step is to perform an inventory of your WordPress installations to confirm if and where the Link Whisper Free plugin is currently active. Once identified, evaluate the business criticality of those specific sites and determine who is responsible for managing them. Prioritize these instances for remediation planning based on their risk profile and direct exposure to the internet.

References

patchstack.com/database/wordpress/plugin/link-whisper/vulnerability/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.