Is CVE-2026-109687 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109687 being exploited in the wild.

How severe is CVE-2026-109687?

High severity, with a CVSS score of 7.6, published 13 October 2026.

Which products and versions are affected?

Link Whisper INC Link Whisper Free through 0.9.7.

Is there a fix for CVE-2026-109687?

Yes: fixed in 0.9.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109687 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109687?

Check whether you run Link Whisper INC Link Whisper Free at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109687: Link Whisper Free SQL injection vulnerability

CVE-2026-109687 · Severity: high · CVSS 7.6 · Published 2026-10-13

Link Whisper Free is a WordPress plugin that helps manage internal linking on websites. A SQL injection vulnerability in versions up to 0.9.7 allows an attacker with editor-level privileges to read, modify, or delete the entire website database, including user accounts and sensitive data. This could lead to complete compromise of the website and exposure of user information.

Technologies: Link Whisper INC Link Whisper Free. Vendors: Link Whisper INC.

Quick answers

Is CVE-2026-109687 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109687 being exploited in the wild.
How severe is CVE-2026-109687?: High severity, with a CVSS score of 7.6, published 13 October 2026.
Which products and versions are affected?: Link Whisper INC Link Whisper Free through 0.9.7.
Is there a fix for CVE-2026-109687?: Yes: fixed in 0.9.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109687 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109687?: Check whether you run Link Whisper INC Link Whisper Free at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.9.8

Technical details

A SQL injection flaw exists in Link Whisper Free that permits blind SQL injection attacks. The vulnerability requires an attacker to have editor-level privileges to exploit. Successful exploitation allows complete database access for reading, modifying, or deleting data; a fix is available in version 0.9.8 and later.

Affected products

Link Whisper INC Link Whisper Free through 0.9.7

Timeline

2026-09-15: disclosed: Reported by mrhaji_8
2026-10-13: advisory: Published by Patchstack

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.